Next.JS vulnerability can lead to DoS via cache poisoning

高 7.5CVE-2025-49826 · GHSA-67rr-84xm-4c7r · 03/07/2025 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
next.js vercel	`= 15.0.4> 15.0.4, < 15.1.8`	`15.1.8`
next npm	`≥ 15.0.4-canary.51, < 15.1.8`	`15.1.8`

概要

Summary

A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page

More details: CVE-2025-49826

Credits

Allam Rachid zhero;
Allam Yasser (inzo)

NVD の説明

Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

参考情報

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-49826 · ADVISORY
vercel/next.js commit 16bfce6 · WEB
vercel/next.js commit a15b974 · WEB
vercel/next.js · PACKAGE
vercel/next.js release v15.1.8 · WEB
vercel.com/changelog/cve-2025-49826 · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

next.js

vercel

= 15.0.4> 15.0.4, < 15.1.8

15.1.8

npm

≥ 15.0.4-canary.51, < 15.1.8