Packages / next / Security

LowVulnerabilityGHSA-r2fc-ccr8-96c4CVE-2025-49005Published 3 Jul 2025

Next.js has a Cache poisoning vulnerability due to omission of the Vary header

Affected releases · next

  • 15.x15.3.0 – 15.3.2Fixed in 15.3.3

On 15.x, the newest line:

npm install next@15.3.3
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Not affected

    15.0.0 – 15.2.9

    32 releases

  2. Affected

    15.3.0 – 15.3.2

    3 releases

  3. Fixed

    15.3.3 – 15.5.28

    47 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Summary

A cache poisoning issue in Next.js App Router >=15.3.0 and < 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3.

Users on affected versions should upgrade immediately and redeploy to ensure proper caching behavior.

More details: CVE-2025-49005