Next.js DoS vulnerability via cache poisoning
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vercel | next.js | 15.0.4-canary.51 to before 15.1.8 | 15.1.8 | Patch available | CNA |
| — | next (npm) | 15.0.4-canary.51 to before 15.1.8 | 15.1.8 | Patch available | GHSA-67rr-84xm-4c7r |
- next.js Vendorvercel Affected 15.0.4-canary.51 to before 15.1.8 Fixed in 15.1.8 Patch available CNA
- next (npm) Vendor— Affected 15.0.4-canary.51 to before 15.1.8 Fixed in 15.1.8 Patch available GHSA-67rr-84xm-4c7r
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | after 15.0.4, before 15.1.8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.0.4:canary51:*:*:*:node.js:*:* | 15.0.4 canary51 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.0.4:canary52:*:*:*:node.js:*:* | 15.0.4 canary52 | Vulnerable | vercel |
- cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions after 15.0.4, before 15.1.8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.0.4:canary51:*:*:*:node.js:*:* Versions 15.0.4 canary51 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.0.4:canary52:*:*:*:node.js:*:* Versions 15.0.4 canary52 Vulnerable ·vercel
Remediation
- Fix · CNA next.js (vercel) Fixed in 15.1.8
- Fix · GHSA-67rr-84xm-4c7r next (npm) Fixed in 15.1.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49826
- 2026-10-03 Alias added: GHSA-67rr-84xm-4c7r
References
Advisory 3
More vercel Next.js vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
- TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
- TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
Sources
- CVE-2025-49826 · CVE Program
- CVE-2025-49826 · NVD
- FIRST EPSS
- GHSA-67rr-84xm-4c7r · GitHub Advisory Database · CC BY 4.0
- CVE-2025-49826 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences