HighGHSA-67rr-84xm-4c7rCVE-2025-49826
Next.JS vulnerability can lead to DoS via cache poisoning
Published 3 Jul 2025 · Updated 3 Jul 2025
Affected package
nextnpm
- Affected
- >=15.0.4-canary.51 <15.1.8
- Fixed in
- 15.1.8
Update to the fixed version for your release line, for example:
npm install next@15.1.8Details
Summary
A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.
Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page
More details: CVE-2025-49826
Credits
- Allam Rachid zhero;
- Allam Yasser (inzo)
Is GHSA-67rr-84xm-4c7r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-49826
- Linkgithub.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2
- Linkgithub.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v15.1.8
- Linkvercel.com/changelog/cve-2025-49826
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.