CVE-2025-49826: Cache poisoning vulnerability in Next.js
A cache poisoning vulnerability in Next.js versions 15.1.0 to 15.1.8 could allow HTTP 204 responses to be incorrectly cached for static pages and served to all users. The vulnerability has been resolved by removing the problematic code path and the race condition that led to cache poisoning.
Summary
Impact
Resolution
Credit
References
A vulnerability affecting Next.js has been addressed. It impacted versions and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.>=15.1.0 <15.1.8
This issue does not impact customers hosted on Vercel.
Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page.
This issue required the below conditions to be exploitable:
The issue was resolved by removing the problematic code path that would have caused the 204 response to be set. Additionally, we removed the race condition that could have led to this cache poisoning by no longer relying on a shared response object to populate the Next.js response cache.
Thanks to Allam Rachid () and Allam Yasser () for responsible disclosure.zheroinzo_
Using an affected version of Next.js, and;
A route using cache revalidation with ISR ( or standalone mode); and
next startA route using SSR, with a CDN configured to cache 204 responses.
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.