Threats Tagged 'ghsa-mcj8-r9mp-w47p'

Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where a shared response cache key is insufficiently scoped. This allows an unauthenticated attacker to poison the cache via a crafted request, potentially causing cross-user content substitution or persistent denial of service until the cache entry is refreshed. The issue is fixed in versions 15.5.27 and 16.3.8.