ID:11283 - Exploit for Acceptance of extraneous untrusted data with trusted data in Next.js - CVE-2024-46982

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when handling HTTP request. A remote non-authenticated attacker can poison the cache of a non-dynamic server-side rendered route in the pages router.

Remediation