{"id":"CVE-2025-32421","published":"2025-05-14T22:56:45Z","modified":"2025-05-15T15:42:26Z","title":"Next.js Race Condition to Cache Poisoning","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00805,"percentile":0.56644,"provenance":"source"},"cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4","tags":["x_refsource_CONFIRM"]},{"url":"https://vercel.com/changelog/cve-2025-32421","tags":["x_refsource_MISC"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":11.33},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":2.59}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-10-11","earliestUrl":"https://github.com/hidesec/CVE-2025-32421","repos":[{"name":"Delfaster/CVE-2025-32421---Race-Condition-Vulnerability---Next.js","url":"https://github.com/Delfaster/CVE-2025-32421---Race-Condition-Vulnerability---Next.js","stars":2,"created":"2025-11-26"},{"name":"hidesec/CVE-2025-32421","url":"https://github.com/hidesec/CVE-2025-32421","stars":1,"created":"2025-10-11"}]},"first":{"date":"2025-10-11","source":"PoC-in-GitHub","url":"https://github.com/hidesec/CVE-2025-32421"},"provenance":"source"},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":["< 14.2.24",">= 15.0.0, < 15.1.6"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=0.9.9, <14.2.24",">=15.0.0, <15.1.6"],"patched":["14.2.24","15.1.6"],"from":["GHSA-qpjv-v59x-3qc4"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-14946","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-46982","published":"2024-09-17","fixed":"14.2.10","kev":false},{"cve":"CVE-2024-51479","published":"2024-12-17","fixed":"14.2.15","kev":false},{"cve":"CVE-2024-56332","published":"2025-01-03","fixed":"15.1.2","kev":false,"link":{"from":"CVE-2024-56332","to":"CVE-2025-32421","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"15.1.2","toFixed":"15.1.6","daysApart":131},{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.21","toFixed":"14.2.24","daysApart":131}]}},{"cve":"CVE-2025-32421","published":"2025-05-14","fixed":"15.1.6","kev":false},{"cve":"CVE-2025-49826","published":"2025-07-03","fixed":"15.1.8","kev":false,"link":{"from":"CVE-2025-32421","to":"CVE-2025-49826","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"15.1.6","toFixed":"15.1.8","daysApart":50}]}},{"cve":"CVE-2025-48068","published":"2025-05-30","fixed":"15.2.2","kev":false},{"cve":"CVE-2025-29927","published":"2025-03-21","fixed":"15.2.3","kev":false}],"package":"npm:next"}}