CVE-2025-49826

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49826
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49826.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49826
Aliases
Published
2025-07-03T21:03:24.346Z
Modified
2026-08-12T03:51:30.914608687Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Next.js DoS vulnerability via cache poisoning
Details

Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49826.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
3970d33e6d4bb055a8596c2b6f7ddbcaa5ca55dc
Fixed
ceaabaf5434dcfab31ba46b5ec2292f30e0f1b16
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "15.0.4-canary.51"
        },
        {
            "fixed": "15.1.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

15.*
15.0.4-canary51
15.0.4-canary52
v15.*
v15.0.4-canary.51
v15.0.4-canary.52
v15.1.0
v15.1.1
v15.1.2
v15.1.3
v15.1.4
v15.1.5
v15.1.6
v15.1.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49826.json"