CVE-2025-49826 Next.js DoS vulnerability via cache poisoning
Attackers can poison the cache to serve empty responses, causing a Denial of Service for users accessing static pages in Next.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49826?
CVE-2025-49826 is a high-severity denial of service vulnerability in Vercel Next.js, published on 3 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
Weakness: CWE-444
Which versions are affected by CVE-2025-49826?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 15.0.4-canary.51 | 15.1.8 |
next npm | From 15.0.4-canary.51 | 15.1.8 |
Products include Vercel Next.js.
How do I fix CVE-2025-49826?
Upgrade next to 15.1.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-49826 being exploited?
There is no known exploitation of CVE-2025-49826 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-67rr-84xm-4c7r.