GitHub Advisoryadvisory · npm

GHSA-qpjv-v59x-3qc4 Next.js Race Condition to Cache Poisoning

LOW Published 2025-05-15 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-32421
Ecosystem
npm
Packages
next
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-362
Reviewed
2025-05-15

Affected packages

• npm next: >= 0.9.9, < 14.2.24 → fixed in 14.2.24 • npm next: >= 15.0.0, < 15.1.6 → fixed in 15.1.6

Description

Summary We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. Learn more here Credit Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.

Related

Alias · CVE (1)

  • CVE-2025-32421 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References