GHSA-qpjv-v59x-3qc4
Next.js Race Condition to Cache Poisoning
At a glance
- Published
- Updated
- CVE
- CVE-2025-32421
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
**Summary** We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. [Learn more here](https://vercel.com/changelog/cve-2025-32421) **Credit** Thank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.
Affected packages
| Package | Versions |
|---|---|
| npm · next | introduced 0.9.9, fixed 14.2.24 |
| npm · next | introduced 15.0.0, fixed 15.1.6 |
References
- https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-32421 ADVISORY
- https://github.com/vercel/next.js PACKAGE
- https://vercel.com/changelog/cve-2025-32421 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |