Executive brief
Next.js is a popular web framework used to build and deploy web applications. A flaw in how Next.js handles HTTP requests allows an attacker to craft malicious requests that are interpreted differently by Next.js and upstream servers, leading to response queue poisoning. This could allow an attacker to inject malicious content into responses intended for other users, potentially compromising data integrity and user trust.
Technical details
This vulnerability is an HTTP request smuggling flaw (CWE-444) stemming from inconsistent interpretation of malformed HTTP requests. The root cause lies in how Next.js parses and processes crafted HTTP requests when the rewrites feature is enabled on an affected route. An attacker can craft a single request that is interpreted as two separate requests by Next.js and the upstream server, causing request/response desynchronization. This leads to response queue poisoning, where responses intended for one user can be sent to another. The attack requires network access but no authentication or user interaction. The vulnerability affects Next.js versions 13.4.0 through 13.5.0 and is patched in 13.5.1 and all 14.x versions.
Affected products
- Vercel Next.js >=13.4.0, <13.5.1
Timeline
- 2024-05-09: disclosed
- 2024-05-09: patched: Fix available in Next.js 13.5.1 and newer (including 14.x)