Other nomination

Eclipse on Next.js: Conditioned exploitation of an intended race-condition

zhero · zhero_web_security · 6 May 2025

Next.js deduplicates in-flight requests with a promise batcher keyed only on path and revalidation flag, so two requests that both fall back to the error page share one result. Racing a request whose pageProps body is overwritten against a plain one returns those pageProps as text/html, reviving the cache-poisoning to stored-XSS chain against external caches.

Record

Researcher

zhero

Published by

zhero_web_security

Date

6 May 2025

In the archive

• Nominated for the 2025 Top 10 Web Hacking Techniques

Related sources

• Earlier Stale Elixir research
• Original cache-poisoning advisory
• Next.js race-condition advisory

Tags

• race-condition
• cache-poisoning
• xss
• nextjs
• cve
• prior-art-extension
• nodejs
• attack-chain
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of zhero, first published at the original source. Preserved copies are kept so the citation survives its host.