CVE-2023-46298: Next Next.js Missing Cache-control Header May Vulnerability

LOW
Advisory Identifier: GHSA-c59h-r6p8-q9wc
Share
Published
Advisory Summary

CVE-2023-46298 is a LOW next.js missing cache-control header may vulnerability (General Security Weakness) affecting Next libraries in the npm ecosystem. The issue involves next.js missing cache-control header may lead to cdn caching empty reply. Remediation is available by upgrading affected packages to version 13.4.20-canary.13.

CVE-2023-46298 at a Glance

CVE Identifier CVE-2023-46298
GHSA Identifier GHSA-c59h-r6p8-q9wc
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Next
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2023-46298

To remediate this vulnerability, upgrade all affected Next dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

next fixed: 13.4.20-canary.13 
npm install next@13.4.20-canary.13
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls next

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2023-46298, inspect your project dependencies using npm:

npm ls next

Analyze the terminal output to locate any version of Next in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 13.4.20-canary.13), your application is affected.

Note: The npm ls next command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Next, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

CVE-2023-46298 Affected Next Versions

1 component(s)
Fixed Versions:
13.4.20-canary.13
Product / Package Ecosystem Affected Versions Fixed Version
next
npm/next
npm
≥ 0.9.9
< 13.4.20-canary.13
13.4.20-canary.13

References

NVD — CVE-2023-46298 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46298
Next Source Repository REPOSITORY
https://github.com/vercel/next.js/issues/45301
Next Source Repository REPOSITORY
https://github.com/vercel/next.js/pull/54732
Security Fix Commit FIX COMMIT
https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
Next Source Repository REPOSITORY
https://github.com/vercel/next.js
Next Source Repository REPOSITORY
https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13

Frequently Asked Questions

What is CVE-2023-46298?
CVE-2023-46298 is a security vulnerability in Next involving Next.js missing cache-control header may lead to CDN caching empty reply under General Security Weakness.
Which Next versions are affected?
Affected versions include releases prior to 13.4.20-canary.13 across affected packages: next.
What version fixes CVE-2023-46298?
Upgrading to 13.4.20-canary.13 (or the latest patched release for your respective branch) resolves the vulnerability.
Is next affected?
Yes, next is affected in releases prior to 13.4.20-canary.13. Upgrade your dependency to 13.4.20-canary.13 or later.
What CWE is associated with CVE-2023-46298?
CVE-2023-46298 is classified under General Security Weakness.
How can I check npm dependencies for CVE-2023-46298?
Run the dependency tree command: 'npm ls next'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c59h-r6p8-q9wc",
  "modified" : "2023-10-24T19:18:58Z",
  "published" : "2023-10-22T03:30:23Z",
  "aliases" : [ "CVE-2023-46298" ],
  "summary" : "Next.js missing cache-control header may lead to CDN caching empty reply",
  "details" : "Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.9.9"
      }, {
        "fixed" : "13.4.20-canary.13"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-46298"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/issues/45301"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/pull/54732"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vercel/next.js"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-10-24T19:18:58Z",
    "nvd_published_at" : "2023-10-22T03:15:07Z"
  }
}