CVE-2024-34350: high-severity vulnerability in vercel next.js
Next.js Vulnerable to HTTP Request Smuggling
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Next.js versions before 13.5.1 can misinterpret specially crafted HTTP requests, causing them to be processed as both a single request and two separate requests simultaneously. This allows attackers to poison the response queue and send unintended responses to other users, especially when the rewrites feature is enabled.
HTTP request smuggling vulnerability in Next.js <13.5.1 arising from inconsistent HTTP request parsing (CWE-444). The attack vector requires a crafted HTTP request to a route using the rewrites feature; the inconsistent interpretation causes desynchronization between Next.js's request parsing and downstream processing, enabling response queue poisoning where responses intended for one client may be delivered to another.
In the same product, most dangerous first.