CVE-2025-49005 Next.js cache poisoning due to omission of Vary header
Attackers can poison caches by serving RSC payloads as HTML, potentially exposing sensitive data or bypassing security controls in self-hosted Next.js deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49005?
CVE-2025-49005 is a low-severity vulnerability in Vercel Next.js, published on 3 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.
Weakness: CWE-444
Which versions are affected by CVE-2025-49005?
2 open source packages ship an affected version, including next. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 15.3.0 | 15.3.3 |
next npm | From 15.3.0 | 15.3.3 |
Products include Vercel Next.js, Vercel Vercel.
How do I fix CVE-2025-49005?
Upgrade next to 15.3.3 or later.
Is CVE-2025-49005 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49005 exists.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as CLEANSTART-2026-SA24453, GHSA-r2fc-ccr8-96c4.