Next.js Cache Poisoning via Charset Mismatch in POST Requests

Executive Summary

This vulnerability affects Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. It involves a server-side fetch request with a body containing invalid UTF-8 byte sequences (like UTF-16) causing cache confusion. The server may return a cached response body from a different request to the same URL but with a different body, potentially leaking confidential data from a POST request's response to unauthorized requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Next.js application uses versions 12.0.0 through 15.5.20 or 16.0.0 through 16.2.10. Inspect server-side fetch requests with non-UTF-8 encoded bodies, particularly those using UTF-16 or other charsets. Monitor for unexpected cached responses or data leaks in POST requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to unauthorized access to confidential data. If an attacker sends a request with a specific UTF-16 encoded body, they might receive a cached response meant for a different request, exposing sensitive information. The impact is limited to requests with non-UTF-8 content types and does not affect the Pages Router.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected Next.js versions may face compliance risks due to potential leaks of sensitive user or patient data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Next.js to versions 15.5.21 or 16.2.11 or later. Ensure all fetch requests use UTF-8 encoded bodies. Review and update cache configurations to prevent response body leaks. Monitor for unusual data access patterns in cached responses.

Useful 0 Not Useful 0