CVE-2025-49826
By Steven Van ·
A Next.js cache poisoning bug in versions 15.1.0 to 15.1.8 could serve a cached 204 response to all visitors of a page.
Vercel patched a Next.js cache poisoning bug affecting versions 15.1.0 up to 15.1.8, tracked as CVE-2025-49826. Under specific conditions, an HTTP 204 response could get cached for a static page and then served to every visitor of that page, a denial of service condition. Vercel says the bug did not affect customers hosted on Vercel.
Exploiting it required all of the following: an affected Next.js version, a route using cache revalidation with ISR (via next start or standalone mode), and a route using SSR behind a CDN configured to cache 204 responses. The fix removes the code path that could set a 204 response and eliminates a race condition by no longer relying on a shared response object to populate the Next.js response cache. Vercel credited Allam Rachid (zhero) and Allam Yasser (inzo_) for the responsible disclosure.