Executive brief
Next.js is a popular web framework for building React applications. When using server-side rendering with middleware, Next.js failed to include proper cache-control headers on prefetch responses, causing CDNs to cache empty responses. This results in users being served stale or incorrect data, degrading application availability and user experience until the cache expires.
Technical details
Next.js versions prior to 13.4.20-canary.13 failed to set the cache-control: no-cache header on prefetch responses for server-side rendered pages when middleware was enabled. The vulnerability occurs during the prefetch phase when Link components request JSON data for server-side props. CDNs like Cloudflare and CloudFront treat these responses as cacheable assets and cache the empty or incomplete responses with their default TTL (often 24 hours), causing subsequent legitimate requests to receive stale data. The issue only manifests when both middleware and Link prefetching are active. The fix, available in version 13.4.20-canary.13 and later, adds explicit cache-control headers to prevent unintended caching.
Affected products
- Vercel Next.js before 13.4.20-canary.13
Timeline
- 2023-10-22: disclosed
- 2023-10-22: patched: Fixed in version 13.4.20-canary.13 and later stable releases