Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "13.4.20"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary0"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary1"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary10"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary11"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary12"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary2"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary3"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary4"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary5"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary6"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary7"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary8"
},
{
"introduced": "0"
},
{
"last_affected": "13.4.20-canary9"
}
]
}