CVE-2025-49826: Next.js DoS vulnerability via cache poisoning
Summary A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.
Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page
More details: CVE-2025-49826
Credits - Allam Rachid zhero; - Allam Yasser (inzo)
Other sources
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49826?
CVE-2025-49826 has been classified as a critical vulnerability due to its potential to cause a Denial of Service (DoS) condition.
How do I fix CVE-2025-49826?
To mitigate CVE-2025-49826, you should upgrade Next.js to version 15.1.8 or later.
Which versions of Next.js are affected by CVE-2025-49826?
CVE-2025-49826 impacts Next.js versions from 15.0.4 to 15.1.8.
What is the nature of the vulnerability in CVE-2025-49826?
CVE-2025-49826 is a cache poisoning vulnerability that can lead to unexpected HTTP response behavior.
What potential impact can CVE-2025-49826 have on applications?
CVE-2025-49826 can result in Denial of Service (DoS), affecting the availability of applications built with the affected versions of Next.js.