| Package | Affected versions | Patched versions |
|---|---|---|
| next.js | = 15.0.4> 15.0.4, < 15.1.8 | 15.1.8 |
| next | ≥ 15.0.4-canary.51, < 15.1.8 | 15.1.8 |
A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.
Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page
More details: CVE-2025-49826
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free