vercel · next.js
Cache poisoning in Next.js, specifically in the pages router's rendering of non-dynamic server-side rendered routes, lets a crafted HTTP request cause a route that should not be cached to be stored in the cache. An unauthenticated remote attacker can trigger this over the network without user interaction, and the poisoned response can also be cached by upstream CDNs that honour the resulting cache headers.
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
First seen exploited 9 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 months after disclosure.
6 related vulnerabilities in the same code over 22 months. The latest fix listed for next is 15.1.6.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: next.
Upgrade to 14.2.25 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2025-29927).
npm install next@14.2.25First fixed in 14.2.10 for CVE-2024-46982.
| If you run | Upgrade to |
|---|---|
| 14.0.0 up to 14.2.10 | 14.2.25first fix for this CVE: 14.2.10 |
| 13.5.1 up to 13.5.7 | 13.5.9first fix for this CVE: 13.5.7 |
“Up to” means the second version is the fix and is not affected.