CVE-2025-49005 in next.js
Summary
by MITRE • 07/04/2025
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2025
This vulnerability affects Next.js applications using the App Router component with versions between 15.3.0 and 15.3.2, alongside Vercel CLI versions from 41.4.1 through 42.1.0, representing a critical cache poisoning flaw that undermines application security. The vulnerability stems from improper handling of cache keys during page request processing, where HTML content requests can inadvertently return React Server Component (RSC) payloads instead of the expected HTML markup. This occurs due to insufficient differentiation between content types in cache key generation mechanisms, creating an exploitable condition where cached responses can be incorrectly served based on content type rather than actual request requirements.
The technical implementation of this vulnerability resides in the caching layer of Next.js's server-side rendering system, where the framework fails to properly segment cache entries for different content types. When a request is made for an HTML page, the system should ensure that the response matches the requested format, but due to flawed cache key logic, RSC payloads can be incorrectly retrieved and served in place of HTML responses. This behavior specifically manifests when applications are deployed outside of Vercel's managed environment where CDN caching policies are more strictly enforced, as the vulnerability only impacts self-hosted deployments where CDN cache key differentiation is not properly implemented.
The operational impact of this vulnerability varies significantly based on deployment environment, creating a nuanced security risk profile. When hosted on Vercel's infrastructure, the vulnerability is limited to browser cache poisoning, meaning that only users who have previously accessed the affected pages might encounter incorrect content, though this still represents a privacy and integrity concern. However, in self-hosted environments where CDN cache keys are not properly segregated between RSC and HTML content, attackers can potentially poison the CDN cache with malicious RSC payloads that would be served to all users, leading to widespread content injection attacks. This represents a direct violation of the principle of least privilege and can enable various attack vectors including cross-site scripting, data exfiltration, and user session manipulation.
The vulnerability aligns with CWE-200 (Information Exposure) and CWE-502 (Deserialization of Untrusted Data) categories, while also mapping to ATT&CK techniques such as T1566 (Phishing) and T1190 (Exploit Public-Facing Application) through potential exploitation pathways. Organizations should immediately upgrade to Next.js version 15.3.3 or later to remediate this vulnerability, ensuring that all deployments are updated consistently across both application servers and CDN infrastructure. Additionally, implementing proper cache key segregation mechanisms and monitoring cache behavior for unexpected content type returns should be considered as additional defensive measures. The fix implemented in Next.js 15.3.3 addresses the root cause by ensuring that cache keys properly differentiate between HTML and RSC content types, preventing the cross-contamination of cached responses that enabled this vulnerability.