TI-2025-23492 Aliases CVE-2025-32421 GHSA-qpjv-v59x-3qc4

Next.js Race Condition to Cache Poisoning

LOW 19CWE-362Published 2025-05-14 · Updated 2025-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00805 57th percentileScored 2026-11-07

Fix Partial next.js (vercel): 14.2.24, 15.1.6next (npm): 14.2.24, 15.1.6Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vercel	next.js	before 14.2.24; 15.0.0 to before 15.1.6	14.2.24, 15.1.6	Patch available	CNA
—	next (npm)	0.9.9 to before 14.2.24	14.2.24	Patch available	GHSA-qpjv-v59x-3qc4
—	next (npm)	15.0.0 to before 15.1.6	15.1.6	Patch available	GHSA-qpjv-v59x-3qc4

next.js Vendorvercel Affected before 14.2.24; 15.0.0 to before 15.1.6 Fixed in 14.2.24, 15.1.6 Patch available CNA
next (npm) Vendor— Affected 0.9.9 to before 14.2.24 Fixed in 14.2.24 Patch available GHSA-qpjv-v59x-3qc4
next (npm) Vendor— Affected 15.0.0 to before 15.1.6 Fixed in 15.1.6 Patch available GHSA-qpjv-v59x-3qc4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vercel:next.js::::::node.js::*	before 14.2.24; 15.0.0 to before 15.1.6	Vulnerable	vercel

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions before 14.2.24; 15.0.0 to before 15.1.6 Vulnerable ·vercel

Remediation

Fix · CNA next.js (vercel) Fixed in 14.2.24, 15.1.6
Fix · GHSA-qpjv-v59x-3qc4 next (npm) Fixed in 14.2.24 Advisory →
Fix · GHSA-qpjv-v59x-3qc4 next (npm) Fixed in 15.1.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)	Affected	No fix yet: Fix deferred
Red Hat Trusted Artifact Signer	Affected	No fix yet: Fix deferred
streams for Apache Kafka 2	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-32421
2026-10-03 Alias added: GHSA-qpjv-v59x-3qc4

References

Advisory 3

Other 1

https://github.com/vercel/next.js

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences