Conversation
|
Semgrep found 1 Risk: Affected versions of next are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). A vulnerability in Next.js can enable an attacker to poison the cache. Under certain conditions, a HTTP 204 response may be cached for static pages, causing all subsequent requests to receive an empty response and effectively leading to a Denial of Service condition. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ISR with cache revalidation (in next start or standalone mode), and route using SSR, and you are not hosting on Vercel Fix: Upgrade this library to at least version 15.1.8 at observability-sdk/yarn.lock:19958. Reference(s): GHSA-67rr-84xm-4c7r, CVE-2025-49826 |
Summary
How did you test this change?
Are there any deployment considerations?