Vulnerability Instance

Next.js Cache Poisoning
### Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. 

To be potentially affected all of the following must apply: 

- Next.js between 13.5.1 and 14.2.9
- Using pages router
- Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`

The below configurations are unaffected:

- Deployments using only app router
- Deployments on [Vercel](https://vercel.com/) are not affected


### Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

### Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

#### Credits

- Allam Rachid (zhero_)
- Henry Chen