GitStock

vercel/next.js · Security

Next.JS vulnerability can lead to DoS via cache poisoning

GHSA ID
GHSA-67rr-84xm-4c7r
CVE ID
CVE-2025-49826
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Summary

A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page

More details: CVE-2025-49826

Credits

  • Allam Rachid zhero;
  • Allam Yasser (inzo)

CWEs

  • CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

References

Open GitHub