Zhero

An improper check for unusual or exceptional conditions exists in Drupal core, allowing for forceful browsing. This issue impacts the software's ability to handle unexpected input or situations, potentially leading to unauthorized access or information disclosure.

The issue allows an attacker to poison the cache of a non-dynamic server-side rendered route in the pages router by sending a crafted HTTP request. This could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header, which some upstream CDNs may also cache. To be potentially affected, all of the following must apply: using Next.js between versions 13.5.1 and 14.2.9, using the pages router, and using non-dynamic server-side rendered routes.