CVE-2025-32421
By Steven Van ·
Vercel-hosted apps are unaffected, while self-hosted Next.js 14.2.24 through 15.1.6 behind a CDN should upgrade or strip a header.
Next.js has a low severity cache poisoning vulnerability, published as CVE-2025-32421 and reported by Vercel in its changelog. It affects Next.js versions 14.2.24 through 15.1.6 and is a bypass of the earlier CVE-2024-46982.
The issue is a race condition between two requests: one with the ?__nextDataRequest=1 query parameter and another with the x-now-route-matches header. Some CDN providers may cache a 200 OK response even without explicit cache-control headers. That lets the response body from a non-cacheable data request be served to later users on a normal request that keeps cacheable headers, such as Cache-Control: public, max-age=300. No backend access or privilege escalation is possible. Exploitation depends on precise timing and a vulnerable CDN configuration.
The fix, in 15.1.6 and 14.2.24, strips the x-now-route-matches header from incoming requests. Applications hosted on Vercel are not affected, because the platform does not cache responses based only on a 200 OK status without explicit cache-control headers.
Self-hosted deployments that cannot upgrade immediately have two workarounds:
- Strip the x-now-route-matches header from all incoming requests at the CDN.
- Set cache-control: no-store for all responses at risk.
Vercel recommends caching only responses that carry explicit cache-control headers. The report credits Allam Rachid (zhero;) for the responsible disclosure, awarded under Vercel's bug bounty program.