Next.js Vulnerable to HTTP Request Smuggling

Next.js versions before 13.5.1 can misinterpret specially crafted HTTP requests, causing them to be processed as both a single request and two separate requests simultaneously. This allows attackers to poison the response queue and send unintended responses to other users, especially when the rewrites feature is enabled.

HTTP request smuggling vulnerability in Next.js <13.5.1 arising from inconsistent HTTP request parsing (CWE-444). The attack vector requires a crafted HTTP request to a route using the rewrites feature; the inconsistent interpretation causes desynchronization between Next.js's request parsing and downstream processing, enabling response queue poisoning where responses intended for one client may be delivered to another.