CVE-2023-46298

Published: Oct 22, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Affected (14)

Products: Vercel: Next.js

Vercel

1 product

Next.js

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Vercel Next.js	Before 13.4.20
Vercel Next.js	Version 13.4.20 canary0
Vercel Next.js	Version 13.4.20 canary10
Vercel Next.js	Version 13.4.20 canary11
Vercel Next.js	Version 13.4.20 canary12
Vercel Next.js	Version 13.4.20 canary1
Vercel Next.js	Version 13.4.20 canary2
Vercel Next.js	Version 13.4.20 canary3
Vercel Next.js	Version 13.4.20 canary4
Vercel Next.js	Version 13.4.20 canary5
Vercel Next.js	Version 13.4.20 canary6
Vercel Next.js	Version 13.4.20 canary7
Vercel Next.js	Version 13.4.20 canary8
Vercel Next.js	Version 13.4.20 canary9