CVE-2025-49005

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49005
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49005.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49005
Aliases
Downstream
Related
Published
2025-07-03T21:01:14.743Z
Modified
2026-03-15T22:21:55.748089Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Next.js cache poisoning due to omission of Vary header
Details

Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

Database specific 
{
    "cwe_ids": [
        "CWE-444"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49005.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
b2ff04995be722a5c93225e16e1c7fcc8bb53f91
Fixed
3ab8db7383ae904af872e14c26a9bd8a43879819

Affected versions

v15.*
v15.3.0
v15.3.1
v15.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49005.json"

Git / github.com/vercel/vercel

Affected ranges

Type
GIT
Repo
https://github.com/vercel/vercel
Events
Introduced
4065d74c3ba5c44cf3a51995a010636bfaac11bc
Fixed
065fd25040a7cba8cd5bd690fcfee5f377d97e5c
Database specific 
{
    "versions": [
        {
            "introduced": "41.4.1"
        },
        {
            "fixed": "42.2.0"
        }
    ]
}

Affected versions

@vercel/build-utils@10.*
@vercel/build-utils@10.5.1
@vercel/client@15.*
@vercel/client@15.1.6
@vercel/client@15.2.0
@vercel/client@15.3.0
@vercel/client@15.3.1
@vercel/firewall@0.*
@vercel/firewall@0.1.7
@vercel/frameworks@3.*
@vercel/frameworks@3.6.3
@vercel/frameworks@3.6.4
@vercel/fs-detectors@5.*
@vercel/fs-detectors@5.3.10
@vercel/fs-detectors@5.3.11
@vercel/fs-detectors@5.4.0
@vercel/fs-detectors@5.4.1
@vercel/functions@2.*
@vercel/functions@2.0.1
@vercel/functions@2.0.2
@vercel/functions@2.0.3
@vercel/functions@2.1.0
@vercel/gatsby-plugin-vercel-builder@2.*
@vercel/gatsby-plugin-vercel-builder@2.0.80
@vercel/gatsby-plugin-vercel-builder@2.0.81
@vercel/mcp-adapter@0.*
@vercel/mcp-adapter@0.2.1
@vercel/mcp-adapter@0.2.2
@vercel/mcp-adapter@0.2.3
@vercel/mcp-adapter@0.2.4
@vercel/mcp-adapter@0.3.0
@vercel/mcp-adapter@0.3.1
@vercel/next@4.*
@vercel/next@4.7.10
@vercel/next@4.7.11
@vercel/next@4.7.4
@vercel/next@4.7.6
@vercel/next@4.7.7
@vercel/next@4.7.8
@vercel/next@4.7.9
@vercel/node@5.*
@vercel/node@5.1.14
@vercel/node@5.1.15
@vercel/node@5.1.16
@vercel/python@4.*
@vercel/python@4.7.2
@vercel/redwood@2.*
@vercel/redwood@2.3.1
@vercel/remix-builder@5.*
@vercel/remix-builder@5.4.3
@vercel/remix-builder@5.4.4
@vercel/remix-builder@5.4.5
@vercel/remix-builder@5.4.6
@vercel/remix-builder@5.4.7
@vercel/static-build@2.*
@vercel/static-build@2.7.6
@vercel/static-build@2.7.7
vercel@41.*
vercel@41.4.1
vercel@41.5.0
vercel@41.6.0
vercel@41.6.1
vercel@41.6.2
vercel@41.7.0
vercel@41.7.2
vercel@41.7.3
vercel@41.7.4
vercel@41.7.6
vercel@41.7.7
vercel@41.7.8
vercel@42.*
vercel@42.0.0
vercel@42.1.0
vercel@42.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49005.json"