GHSA-9pq4-5hcf-288c
Cache poisoning in @sveltejs/adapter-vercel
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @sveltejs/adapter-vercel | < 6.3.2 | 6.3.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `@sveltejs/adapter-vercel` prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.
Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.
Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.
References
External links from the advisory. They lead to third-party sites.