CVE-2023-46298 Next.js missing cache-control header may lead to CDN caching empty reply
Attackers can cause denial of service by exploiting missing cache-control headers that allow CDNs to cache empty prefetch responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46298?
CVE-2023-46298 is a high-severity denial of service vulnerability in Vercel Next.js, published on 22 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
Which versions are affected by CVE-2023-46298?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 0.9.9 | 13.4.20-canary.13 |
next npm | From 0.9.9 | 13.4.20-canary.13 |
Products include Vercel Next.js.
How do I fix CVE-2023-46298?
Upgrade next to 13.4.20-canary.13 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46298 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46298 exists.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-c59h-r6p8-q9wc.