Packages / next / Security

HighVulnerabilityGHSA-67rr-84xm-4c7rCVE-2025-49826Published 3 Jul 2025

Next.JS vulnerability can lead to DoS via cache poisoning

Affected releases · next

  • 15.x15.0.4 – 15.1.7Fixed in 15.1.8

On 15.x, the newest line:

npm install next@15.1.8
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Not affected

    15.0.0 – 15.0.3

    4 releases

  2. Affected

    15.0.4 – 15.1.7

    13 releases

  3. Fixed

    15.1.8 – 15.5.28

    65 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Summary

A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page

More details: CVE-2025-49826

Credits

  • Allam Rachid zhero;

  • Allam Yasser (inzo)