GHSA-67rr-84xm-4c7rHighCVSS 7.5

Next.JS vulnerability can lead to DoS via cache poisoning

Published
July 3, 2025
Last Modified
July 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-49826 →

📋 Description

Summary

A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page

More details: CVE-2025-49826

Credits

  • Allam Rachid zhero;
  • Allam Yasser (inzo)

🎯 Affected products1

  • npm/next:>= 15.0.4-canary.51, < 15.1.8

🔗 References (7)