Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
AnalysisAI
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Affected products include: Vercel Next.Js. Version information: before 13.4.20.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5),
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remot
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerabi
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today