What is GHSA-qpjv-v59x-3qc4?

GHSA-qpjv-v59x-3qc4 is a security advisory published by GitHub Security Advisories with Low severity. Next.js Race Condition to Cache Poisoning

Which CVE IDs does GHSA-qpjv-v59x-3qc4 cover?

GHSA-qpjv-v59x-3qc4 covers the following CVE IDs: CVE-2025-32421. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qpjv-v59x-3qc4?

GHSA-qpjv-v59x-3qc4 has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-qpjv-v59x-3qc4?

GHSA-qpjv-v59x-3qc4 affects 2 products, including: npm/next:\u003e= 15.0.0, \u003c 15.1.6; npm/next:\u003e= 0.9.9, \u003c 14.2.24.

GHSA-qpjv-v59x-3qc4LowCVSS 3.7

Next.js Race Condition to Cache Poisoning

Vendor

GitHub Security Advisories

Published

May 15, 2025

Last Modified

September 26, 2025

🔗 CVE IDs covered (1)

CVE-2025-32421 →

📋 Description

Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.

Learn more here

Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.

🎯 Affected products2

npm/next:>= 15.0.0, < 15.1.6
npm/next:>= 0.9.9, < 14.2.24

🔗 References (4)

https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
https://nvd.nist.gov/vuln/detail/CVE-2025-32421
https://vercel.com/changelog/cve-2025-32421
https://github.com/advisories/GHSA-qpjv-v59x-3qc4