CVE-2025-49826highCWE-444

CVE-2025-49826: high-severity vulnerability in vercel next.js

Next.js DoS vulnerability via cache poisoning

Published · Updated

Follow this CVE+ Monitor next.js+ Monitor next

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.1%
In short

Next.js has a caching bug that can cause a web server to respond with a 204 (no content) error to all users visiting a page, making that page unavailable. An attacker can trigger this by crafting specific HTTP requests, disrupting service for everyone.

Technical detail

A cache poisoning vulnerability in Next.js versions 15.0.4-canary.51 through 15.1.7 allows HTTP 204 responses to be incorrectly cached for static pages under certain conditions, leading to DoS via widespread cache corruption. The attack vector involves HTTP requests that trigger improper cache storage, affecting all subsequent requests to the poisoned page. Remediated in version 15.1.8.

Summary generated and translated by AI from the official description.
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
vercel · next.js
Related CVEs — vercel next.js

In the same product, most dangerous first.

CVE-2025-29927CRITICALAuthorization Bypass in Next.js MiddlewareEPSS 99.2%CVE-2024-46982HIGHCache Poisoning in next.jsEPSS 59.2%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 47.3%CVE-2026-44578HIGHNext.js: Server-side request forgery in applications using WebSocket upgradesEPSS 35.5%CVE-2024-34351HIGHNext.js Server-Side Request Forgery in Server ActionsEPSS 5.5%CVE-2024-51479HIGHAuthorization bypass in Next.jsEPSS 4.0%