7.5

CVE-2024-46982: vercel next.js

CVSS: 7.5v3.1HighAnalyzed
AliasesCGA-9xjh-r8mq-hh89CGA-fhr3-747p-hpf6CGA-j8fh-xm72-p3mf
Published 17-09-2024Last modified 18-09-2024
Open JSON

Vulnerability summary

CVE-2024-46982 is a high (CVSS 7.5) vulnerability in vercel next.js. EPSS estimates a 59.18% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
59.18%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-GC23-JP54-8CG6

Timeline

  1. 17-09-2024
    PublishedVulnerability first disclosed.
  2. 18-09-2024
    Last modifiedVulnerability information updated.

Description

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

59.18%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 59.18% on 21-09-2026

21-09-202621-10-2026
EPSS score
59.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • jitsucom-jitsu< 2.8.2-r1
  • jitsucom-jitsu-console< 2.8.2-r1
  • jitsucom-jitsu-rotor< 2.8.2-r1
Wolfi3 products
  • jitsucom-jitsu< 2.8.2-r1
  • jitsucom-jitsu-console< 2.8.2-r1
  • jitsucom-jitsu-rotor< 2.8.2-r1
Npm1 product
  • next≥ 13.5.1, < 13.5.7 | ≥ 14.0.0, < 14.2.10
Vercel1 product
  • next.js≥ 13.5.1, < 13.5.7 | ≥ 14.0.0, < 14.2.10

4 vendors · 8 products

References

6 links