Next.js CVE-2025-32421 Cache Poisoning Vulnerability Advisory

Key Information Vulnerability Overview CVE ID: CVE-2025-32421 Affected Versions: Next.js >14.2.24 and <15.1.6 Vulnerability Type: Cache Poisoning Severity: Low Vulnerability Details Description: Attackers exploit a race condition between two requests—one containing the query parameter and the other carrying the header. Impact: Certain CDN providers may cache a response even without an explicit header, leading to poisoned responses being served to subsequent users. Scope of Impact Attack Vector: Attackers can inject the response body of a non-cacheable data request into a legitimate request, thereby poisoning the CDN cache. Risk: Successful exploitation depends on precise timing and vulnerable CDN configurations. Mitigation Patch: Fixed in versions 15.1.6 and 14.2.24 by stripping the header from incoming requests. Vercel Platform Mitigation: Applications hosted on the Vercel platform are unaffected, as the platform does not cache responses based solely on status codes unless an explicit header is present. Remediation Temporary Workarounds: - Strip the header from all incoming requests. - Set for all responses at risk. Recommended Practice: Cache only responses that include an explicit header. Acknowledgments Discoverer: Allam Rachid (zhero), recognized for responsible disclosure and awarded a bounty.

Goal Reached Thanks to every supporter — we hit 100%!

Next.js CVE-2025-32421 Cache Poisoning Vulnerability Advisory