vercel Next.js up to 14.2.23/15.1.5 race condition

Summaryinfo

A vulnerability was found in vercel Next.js up to 14.2.23/15.1.5. It has been rated as problematic. This affects an unknown part. This manipulation causes race condition. The identification of this vulnerability is CVE-2025-32421. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in vercel Next.js up to 14.2.23/15.1.5. It has been declared as problematic. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality. The summary by CVE is:

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-32421 since 04/08/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 260286 (Linux Distros Unpatched Vulnerability : CVE-2025-32421), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 14.2.24 or 15.1.6 eliminates this vulnerability. The upgrade is hosted for download at vercel.com.

The vulnerability is also documented in the databases at Tenable (260286) and EUVD (EUVD-2025-14946). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• Next.js

Version

• 14.2.0
• 14.2.1
• 14.2.2
• 14.2.3
• 14.2.4
• 14.2.5
• 14.2.6
• 14.2.7
• 14.2.8
• 14.2.9
• 14.2.10
• 14.2.11
• 14.2.12
• 14.2.13
• 14.2.14
• 14.2.15
• 14.2.16
• 14.2.17
• 14.2.18
• 14.2.19
• 14.2.20
• 14.2.21
• 14.2.22
• 14.2.23
• 15.1.0
• 15.1.1
• 15.1.2
• 15.1.3
• 15.1.4
• 15.1.5

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion