High severity · published Jul 3, 2025
CVE-2025-49826
Next.js is a React framework for building full-stack web applications
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Next.js · Vercel
after 15.0.4 before 15.1.8; 15.0.4; 15.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49826
Patch
https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93
Release Notes
https://github.com/vercel/next.js/releases/tag/v15.1.8
Vendor Advisory
https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
Vendor Advisory
https://vercel.com/changelog/cve-2025-49826
More from Next.js
10.0
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
9.1
CVE-2025-29927
Next.js is a React framework for building full-stack web applications
9.0
CVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
8.6
CVE-2026-44578
Next.js: Server-side request forgery in applications using WebSocket upgrades
8.2
CVE-2026-94482
Next.js: Denial of Service in App Router using Server Actions