Collected research
Eclipse on Next.js: Conditioned exploitation of an intended race-condition
Next.js deduplicates in-flight requests with a promise batcher keyed only on path and revalidation flag, so two requests that both fall back to the error page share one result. Racing a request whose pageProps body is overwritten against a plain one returns those pageProps as text/html, reviving the cache-poisoning to stored-XSS chain against external caches.
Record
- Researcher
- zhero
- Published by
- zhero_web_security
- Date
- Topic
- Other
In the archive
Related sources
- Next.js, cache, and chains: the stale elixir
- Original cache-poisoning advisory Advisory
- Next.js race-condition advisory Advisory
Tags
This page is the archive's own catalogue record. The research is the work of zhero, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .