CVE-2023-46298: Vercel Next.js DOS Vulnerability

CVE-2023-46298 Overview

CVE-2023-46298 is a Denial of Service vulnerability affecting Vercel Next.js versions before 13.4.20-canary.13. The vulnerability stems from a missing cache-control header in prefetch responses, which can lead to empty responses being cached by Content Delivery Networks (CDNs). When these malformed responses are cached, all users requesting the same URL through the affected CDN will receive the cached empty response, resulting in a widespread denial of service condition.

Critical Impact

This vulnerability can cause complete service disruption for all users accessing affected URLs through a CDN, potentially impacting high-traffic Next.js applications at scale.

Affected Products

• Vercel Next.js versions prior to 13.4.20-canary.13
• Vercel Next.js 13.4.20-canary.0 through 13.4.20-canary.12
• Next.js applications deployed behind CDN infrastructure

Discovery Timeline

• 2023-10-22 - CVE-2023-46298 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-46298

Vulnerability Analysis

This vulnerability affects Next.js's prefetch functionality, a performance optimization feature that pre-loads page data to improve navigation speed. The core issue lies in how Next.js handles HTTP response headers for prefetch requests. When a prefetch request results in an empty response, the framework fails to include appropriate cache-control headers that would instruct CDNs not to cache these responses.

CDNs typically rely on cache-control headers to determine caching behavior. Without explicit directives indicating that a response should not be cached or has a specific cache duration, CDNs may apply default caching policies. In this case, empty prefetch responses become candidates for caching, and once cached, they poison the CDN's cache for that specific URL.

The impact is significant because CDNs serve cached content to all users within their geographic region or edge location. A single empty prefetch response cached by the CDN can effectively take down that URL for potentially thousands of users until the cache expires or is manually purged.

Root Cause

The root cause is the absence of proper cache-control header implementation in Next.js's prefetch response handling logic. The framework should include headers such as Cache-Control: no-store or Cache-Control: private for empty prefetch responses to prevent CDN caching. This header omission allowed intermediate caching layers to store and serve empty responses as legitimate content.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker or even normal user activity could trigger the vulnerable condition:

1. A request triggers a prefetch operation that returns an empty response
2. The CDN caches this empty response due to missing cache-control headers
3. Subsequent users requesting the same URL receive the cached empty response
4. The affected URL becomes inaccessible until the CDN cache is purged or expires

The vulnerability can manifest through normal application usage patterns, making it particularly insidious as it may appear as intermittent service issues rather than a targeted attack.

Detection Methods for CVE-2023-46298

Indicators of Compromise

• Intermittent blank pages or empty responses for specific URLs across multiple users
• User reports of pages loading correctly on refresh but failing on subsequent visits
• CDN logs showing successful cache hits returning empty or zero-byte responses
• Sudden increase in user complaints about page availability from specific geographic regions

Detection Strategies

• Monitor CDN cache hit ratios and response sizes for anomalies indicating empty cached responses
• Implement synthetic monitoring to detect empty responses from CDN edge locations
• Review Next.js prefetch response headers to verify cache-control directives are present
• Analyze CDN access logs for patterns of empty responses being served with cache hit indicators

Monitoring Recommendations

• Configure alerting for response body size anomalies on critical application endpoints
• Implement CDN cache inspection tools to identify potentially poisoned cache entries
• Monitor error rates across CDN edge locations for regional outage patterns
• Set up automated checks to verify proper cache-control headers on prefetch responses

How to Mitigate CVE-2023-46298

Immediate Actions Required

• Upgrade Next.js to version 13.4.20-canary.13 or later immediately
• Purge CDN caches for affected Next.js applications after upgrading
• Review CDN configuration to add protective rules for empty response caching
• Monitor application endpoints for signs of cache poisoning until upgrade is complete

Patch Information

Vercel has addressed this vulnerability in Next.js version 13.4.20-canary.13 and subsequent releases. The fix adds proper cache-control headers to prefetch responses, preventing CDNs from caching empty responses. Technical details of the fix can be found in the GitHub Pull Request #54732 and the version comparison between canary.12 and canary.13.

For additional context on the issue, see GitHub Issue #45301.

Workarounds

• Configure CDN rules to prevent caching of empty or zero-byte responses
• Add custom middleware to inject cache-control headers for prefetch routes
• Implement CDN cache key normalization to limit cache poisoning scope
• Configure shorter TTLs for prefetch-related URLs as a temporary measure

# Example CDN configuration (Cloudflare Page Rule or similar)
# Prevent caching empty responses for Next.js prefetch routes
# Add a Page Rule or Transform Rule:
# URL Pattern: */_next/data/*
# Cache Control: no-store
# Or set minimum cacheable response size > 0 bytes