next@14.1.1-canary.82 vulnerabilities

next is a react framework.

Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data by sending a crafted HTTP request, which allows the attacker to poison the cache of a non-dynamic server-side rendered route in the page router. This will coerce the request to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, a stale-while-revalidate header, which some upstream CDNs may cache as well.

Note:

This is only vulnerable if:

1. The user is using pages router

2. The user is using non-dynamic server-side rendered routes.

Users are not affected if:

1. They are using the app router

2. The deployments are on Vercel

Upgrade next to version 13.5.7, 14.2.10 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) through the Host header manipulation. An attacker can make unauthorized requests appearing to originate from the server.

Notes:

Prerequisites:

1. Next.js (<14.1.1) is running in a self-hosted manner.

2. The Next.js application makes use of Server Actions.

3. The Server Action performs a redirect to a relative path which starts with a /.

Upgrade next to version 14.1.1 or higher.