LowGHSA-r2fc-ccr8-96c4CVE-2025-49005
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
Published 3 Jul 2025 · Updated 10 Sept 2026
Affected package
nextnpm
- Affected
- >=15.3.0 <15.3.3
- Fixed in
- 15.3.3
Update to the fixed version for your release line, for example:
npm install next@15.3.3Details
Summary
A cache poisoning issue in Next.js App Router >=15.3.0 and < 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3.
Users on affected versions should upgrade immediately and redeploy to ensure proper caching behavior.
More details: CVE-2025-49005
Is GHSA-r2fc-ccr8-96c4 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-49005
- Linkgithub.com/vercel/next.js/issues/79346
- Linkgithub.com/vercel/next.js/pull/79939
- Linkgithub.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v15.3.3
- Linkvercel.com/changelog/cve-2025-49005
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.