How can I trigger a "Failed to update prerender cache" error?

[thomaux]

Summary

We've had an issue in production where page requests were returning stale data. Upon inspecting the logs, we noticed this error getting logged when loading the page:

Failed to update prerender cache for /PAGE TypeError [ERR_INVALID_ARG_TYPE]: The "data" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received undefined

We believe this error was causing our problem, however I would like to be able to reproduce this scenario locally. Does anyone know how I can trigger this error? The page in question has no server side or static props.

Many thanks in advance!

Additional information

No response

Example

No response

[icyJoseph]

So, this code happens on this try catch,

next.js/packages/next/src/server/lib/incremental-cache/index.ts

Line 594 in 645ef16

console.warn('Failed to update prerender cache for', pathname, error)

      await this.cacheHandler?.set(pathname, data, ctx)

So, I could speculate, that a fetch all, or data request in general, resolved to undefined, rather than null, for a given missing value?

[beatrizdemiguelperez]

Same here, did you find something?

[thomaux]

Unfortunately no way to reproduce the issue, however the root cause was due to a vulnerability in the next version we were using.

This is the vulnerability: GHSA-gp8f-8m3g-qvj9.

[icyJoseph]

Ufff... do you think you might have been attacked?

[joel-vaz]

@thomaux was right with the cache poisoning he mentioned above ^

If anyone is still facing this issue we were able to replicate it and mitigate, from our understanding nextJs currently has vulnerabilities that were being exploited by a security expert -> bounty bug/security finding process.

If you pass a specific custom header to your endpoint you will be able to replicate the issue we faced. You page will enforce a static cached behaviour, removing the force dynamic aspects.

The solution for us was to block this header on our CDN and we ensured that our endpoints remain healthy 🙏

We were using NextJs: 14.2.5

Additional reading:

https://cyberpress.org/critical-vulnerability-in-next-js-framework-exposes-websites/

https://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixir (edited)

[beatrizdemiguelperez]

Huge thanks @thomaux, You gave us the key! 🙏

[thomaux]

Glad to hear that @beatrizdemiguelperez !