CVE-2023-46298 in Next.js
Summary
by MITRE • 10/25/2023
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2025
The vulnerability identified as CVE-2023-46298 affects Next.js versions prior to 13.4.20-canary.13 and represents a critical caching misconfiguration that can lead to widespread denial of service conditions. This issue stems from the absence of proper cache-control headers in empty prefetch responses generated by the framework, creating a scenario where content delivery networks may inadvertently cache these responses. The flaw manifests when prefetch requests return empty content, yet these empty responses are cached by CDNs for extended periods, effectively blocking legitimate user access to the affected URLs.
The technical root cause of this vulnerability lies in the improper handling of HTTP cache directives within Next.js prefetch functionality. When Next.js generates prefetch responses for routes that may not contain data, it fails to include appropriate cache-control headers that would prevent caching of empty responses. This oversight creates a condition where CDNs, following standard caching behaviors, store these empty responses in their edge locations. The absence of cache-control headers with directives such as 'no-cache', 'no-store', or 'private' allows intermediaries to treat these responses as cacheable content, leading to a scenario where malicious actors or system anomalies can trigger caching of empty responses that persist for extended periods.
The operational impact of this vulnerability extends beyond simple performance degradation to represent a potential denial of service attack vector that can affect entire user bases. When a CDN caches an empty prefetch response, all subsequent requests for the same URL through that CDN will receive the cached empty response instead of the actual content. This creates a cascading effect where legitimate users experience complete service disruption, as their requests are served cached empty responses rather than dynamic content. The vulnerability is particularly concerning because prefetch responses are typically generated automatically by Next.js to improve user experience, making it difficult for developers to identify and mitigate the issue without explicit monitoring of CDN behavior.
This vulnerability aligns with CWE-501 and CWE-352 security weaknesses, representing a cache poisoning scenario where improperly configured cache control mechanisms allow for the caching of inappropriate content. The issue also maps to ATT&CK technique T1499.004, which involves network denial of service through resource exhaustion, as the cached empty responses consume CDN resources and prevent proper content delivery. The vulnerability demonstrates a failure in the principle of least privilege and proper resource management, where the framework does not adequately control how its responses are cached across the content delivery infrastructure.
Mitigation strategies for CVE-2023-46298 primarily focus on updating to Next.js version 13.4.20-canary.13 or later, which includes proper cache-control header implementation for prefetch responses. Organizations should also implement monitoring systems to detect unusual caching patterns in their CDN configurations and establish automated alerts for empty response caching. Network administrators should review their CDN configurations to ensure that prefetch responses are explicitly marked as non-cacheable through appropriate cache-control headers. Additionally, developers should consider implementing custom middleware solutions that explicitly set cache-control headers for prefetch endpoints, providing an additional layer of protection against similar issues in other frameworks or custom implementations. The vulnerability highlights the importance of comprehensive security testing across the entire application delivery chain, including CDN configurations and cache behavior testing.