CVE-2025-49005
By Steven Van ·
A cache poisoning bug in Next.js App Router and Vercel CLI could serve RSC payloads as HTML; fixed in Next.js 15.3.3.
A cache poisoning issue in Next.js App Router (versions 15.3.0 to below 15.3.3) and Vercel CLI (41.4.1 to 42.2.0) has been fixed under CVE-2025-49005. Under specific conditions involving middleware redirects and omitted Vary headers, page requests for HTML could return a React Server Component (RSC) payload instead, which then got cached and could display broken or incorrect client content. The bug occurred when a middleware redirect stripped the framework's cache-busting parameter, breaking cache key separation between RSC and HTML responses.
- On Vercel, the issue only affected the browser cache, not the CDN.
- Self-hosted deployments could see CDN cache poisoning if their CDN doesn't distinguish RSC from HTML in cache keys.
- Next.js 15.3.3 fixes this by correctly setting the Vary header to separate RSC and HTML responses.
- Customers hosting on Vercel with an affected CLI version must redeploy to get the fix.
- Until then, workarounds are to manually set Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch on RSC responses, or to apply a unique cache-busting search parameter to the middleware redirect destination.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →