CVE-2024-46982

CVE-2024-46982 is a cache-poisoning flaw in Next.js, Vercel's React full-stack web framework, in which a crafted HTTP request makes Next.js cache a non-dynamic, server-side rendered route in the pages router that was intended not to be cached (the app router is not affected). By sending such a crafted request, an unauthenticated attacker can coerce Next.js to treat a normally uncached route as cacheable and emit a `Cache-Control: s-maxage=1, stale-while-revalidate` header that some upstream CDNs and shared caches honor, so unintended cached responses can be served to subsequent visitors; the CVSS 3.1 score of 7.5 rates the impact as high for availability. A deployment is potentially affected only if all three conditions hold: Next.js between 13.5.1 and 14.2.9, use of the pages router, and at least one non-dynamic SSR route such as `pages/dashboard.tsx` (not dynamic routes like `pages/blog/[slug].tsx`). The flaw is fixed in Next.js 13.5.7 and 14.2.10 and later, and there are no officially recommended workarounds, so patching is the primary remediation. No exploitation is currently confirmed - it is not in CISA KEV and no public proof-of-concept is known - but EPSS assigns a 59.2% probability of exploitation within 30 days (99th percentile), so exposure is expected to grow.

What to do: Upgrade to Next.js 13.5.7 or 14.2.10 (or later); no workarounds are officially recommended, so patching is the primary remediation, and Vercel advises upgrading even if you cannot reproduce the issue. Audit your deployment for the three conditions: pages router usage, Next.js 13.5.1-14.2.9, and non-dynamic SSR routes (e.g., pages/dashboard.tsx), and check whether responses from such routes are cached by an upstream CDN honoring s-maxage/stale-while-revalidate.