CVE-2024-46982: Next.js pages router cache poisoning via crafted HTTP request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network, no-auth, no-interaction reach and a 99th-percentile EPSS score make this a high-priority patch despite no KEV listing.

What it is

Next.js versions 13.5.1 through 14.2.9 can be coerced into caching non-dynamic server-side rendered pages router routes when a crafted HTTP request is sent. The poisoned response carries a Cache-Control: s-maxage=1, stale-while-revalidate header that upstream CDNs may also cache, so the wrong content can be served to other users. It does not affect the app router, and only pages router non-dynamic SSR routes are exposed.

Impact

An unauthenticated attacker can poison the cache so that other visitors receive attacker-influenced cached responses for affected routes, degrading integrity of served content and availability of the intended page. The CVSS vector scores availability impact only (C:N/I:N/A:H), so the record does not establish confidentiality or integrity loss.

Attack surface

Reachable over the network by sending a crafted HTTP request to a non-dynamic server-side rendered pages router route; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The app router is not affected.

Exploitation

Not listed in CISA KEV and no public exploit reference is included, but EPSS is high at 0.5918 (99th percentile), indicating elevated likelihood of exploitation activity. References are limited to patch commits and a vendor advisory.

What to do

• Upgrade Next.js to 13.5.7, 14.2.10, or a later release; patching is the only recommended fix.
• If immediate upgrade is not possible, review CDN and reverse-proxy caching rules so responses with s-maxage=1, stale-while-revalidate are not cached for affected routes.
• Audit pages router non-dynamic SSR routes and confirm which are exposed to untrusted traffic.
• Monitor vendor advisory GHSA-gp8f-8m3g-qvj9 and patch commits for any updated guidance, since no official workaround exists.

Detection

• Inspect CDN and origin logs for requests that trigger Cache-Control: s-maxage=1, stale-while-revalidate on pages router SSR routes.
• Alert on unexpected cache HITs or cache fills for routes that should not be cached.
• Compare cached response bodies against origin responses for non-dynamic SSR pages to spot poisoned entries.
• Track Next.js version inventory to identify hosts still running 13.5.1 through 14.2.9.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.