MEDIUM
GHSA-9pq4-5hcf-288c
Cache poisoning in @sveltejs/adapter-vercel
Quick fix
GHSA-9pq4-5hcf-288c — @sveltejs/adapter-vercel: upgrade to the fixed version with the command below.
npm install @sveltejs/adapter-vercel@6.3.2Details
Versions of `@sveltejs/adapter-vercel` prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.
Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.
Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@sveltejs/adapter-vercel
Introduced in:
0Fixed in: 6.3.2Fix
npm install @sveltejs/adapter-vercel@6.3.2