Uploaded September 2026 | Updated September 2026, 4 days ago
Every cache poisoning writeup you have read aims at the CDN, because the CDN is the only cache that answers when you knock. Behind it your framework runs a response cache of its own, on disk, that sends no X-Cache and no Age and keys on the pathname instead of the URL. That is why your cache buster does nothing there. In this one I poison that inner cache with a single unauthenticated header, show what the patch actually changed and why the trust is still in the code, then build a zero click stored XSS on current stable Next.js out of two things that are not vulnerabilities on their own.
🎯 Get My Full Caido Course: hhub.io/AMRCAIDO
💡 Support AmrSec on Patreon:
patreon.com/AmrSec
🔥 Join Our Community:
Discord: discord.gg/nxHKyJTy3h
📁 Resources
Video Article: amrelsagaei.com/cache-poisoning-the-cache-you-cant-purge
HTTP Header Exploitation: yeswehack.com/learn-bug-bounty/http-header-exploitation
⭐ Become a Channel Member:
youtube.com/@AmrSecOfficial/join
⚠️ Disclaimer
This channel is for educational purposes only. The goal is to teach cybersecurity, ethical hacking, and red team/blue team skills through real tools, techniques, and experience. Always hack ethically. 🫡
🕐 Timestamps
00:00 — Introduction
01:54 — The three cache layers
04:29 — Poisoning the framework cache
12:42 — What the patch actually changed
14:37 — The RSC reflection chain
20:39 — Why the payload isn't escaped
22:42 — Caching the payload and removing the click
27:53 — How to hunt and report it
30:30 — Recap and outro
Follow AmrSec
LinkedIn: linkedin.com/in/amrelsagaei
Twitter/X: twitter.com/amrelsagaei
Instagram: instagram.com/amrelsagaei
#CachePoisoning #BugBounty #WebSecurity #NextJS #EthicalHacking
Every cache poisoning writeup you have read aims at the CDN, because the CDN is the only cache that answers when you knock. Behind it your framework runs a response cache of its own, on disk, that sends no X-Cache and no Age and keys on the pathname instead of the URL. That is why your cache buster does nothing there. In this one I poison that inner cache with a single unauthenticated header, show what the patch actually changed and why the trust is still in the code, then build a zero click stored XSS on current stable Next.js out of two things that are not vulnerabilities on their own.
🎯 Get My Full Caido Course: hhub.io/AMRCAIDO
💡 Support AmrSec on Patreon:
patreon.com/AmrSec
🔥 Join Our Community:
Discord: discord.gg/nxHKyJTy3h
📁 Resources
Video Article: amrelsagaei.com/cache-poisoning-the-cache-you-cant-purge
HTTP Header Exploitation: yeswehack.com/learn-bug-bounty/http-header-exploitation
⭐ Become a Channel Member:
youtube.com/@AmrSecOfficial/join
⚠️ Disclaimer
This channel is for educational purposes only. The goal is to teach cybersecurity, ethical hacking, and red team/blue team skills through real tools, techniques, and experience. Always hack ethically. 🫡
🕐 Timestamps
00:00 — Introduction
01:54 — The three cache layers
04:29 — Poisoning the framework cache
12:42 — What the patch actually changed
14:37 — The RSC reflection chain
20:39 — Why the payload isn't escaped
22:42 — Caching the payload and removing the click
27:53 — How to hunt and report it
30:30 — Recap and outro
Follow AmrSec
LinkedIn: linkedin.com/in/amrelsagaei
Twitter/X: twitter.com/amrelsagaei
Instagram: instagram.com/amrelsagaei
#CachePoisoning #BugBounty #WebSecurity #NextJS #EthicalHacking
