What’s Vulnerable › Vulnerabilities

CVE-2023-46298: Next.js missing cache-control header may lead to CDN caching empty reply

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-22 · updated 2026-06-17

Description

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Affected products

• Next.js: before 13.4.20; 13.4.20-canary0, 13.4.20-canary1, 13.4.20-canary10, 13.4.20-canary11, 13.4.20-canary12, 13.4.20-canary2 (+7) — fixed in 13.4.20
• Npm Next: from 0.9.9 before 13.4.20-canary.13 — fixed in 13.4.20-canary.13

How to fix

Upgrade to a fixed version: Next.js 13.4.20; Npm Next 13.4.20-canary.13. Check the vendor advisory for mitigations.

References

• https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
• https://github.com/vercel/next.js/issues/45301
• https://github.com/vercel/next.js/pull/54732
• https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
• https://github.com/vercel/next.js/issues/45301
• https://github.com/vercel/next.js/pull/54732

Get alerted when CVE-2023-46298 or the next vulnerability affects your stack