nextjs-cache-poisoning

What problem does it solve?

This Skill solves the problem of identifying and validating internal cache poisoning vulnerabilities in Next.js applications that arise from misconfigured stale cache settings and insufficient header validation, which can allow attackers to inject malicious content served to multiple users via shared caches.

Core Features & Use Cases

• Vulnerability Detection: Identifies viable Next.js cache poisoning targets by checking for x-nextjs-cache headers and s-maxage/stale-while-revalidate cache directives.
• Exploitation Execution: Injects test content via x-now-route-matches header manipulation to poison both SSR page responses and JSON data endpoints under /_next/data/.
• Impact Validation: Confirms cross-user cache impact by verifying poisoned content is served to other users, not just the attacker's session, and provides steps to maintain poisoned entries during the stale-while-revalidate window.
• Use Case: Red teamers assessing Next.js applications can use this Skill to test whether misconfigured shared cache settings allow persistent, cross-user content injection without direct application vulnerabilities.

Quick Start

Use the nextjs-cache-poisoning skill to test a target Next.js application for cache poisoning vulnerabilities by identifying routes with viable cache settings, injecting test content via header manipulation, and confirming the poisoned response is served to other users.