GitHub Advisoryadvisory · npm

GHSA-r2fc-ccr8-96c4 Next.js has a Cache poisoning vulnerability due to omission of the Vary header

LOW Published 2025-07-03 Modified 2025-07-03 Official page ↗
Aliases
CVE-2025-49005
Ecosystem
npm
Packages
next
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-444
Reviewed
2025-07-03

Affected packages

• npm next: >= 15.3.0, < 15.3.3 → fixed in 15.3.3

Description

Summary A cache poisoning issue in Next.js App Router >=15.3.0 and < 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3. Users on affected versions should upgrade immediately and redeploy to ensure proper caching behavior. More details: CVE-2025-49005

Related

Alias · CVE (1)

  • CVE-2025-49005 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References