# CVE-2025-32421 By Steven Van · 2025-04-22 Vercel-hosted apps are unaffected, while self-hosted Next.js 14.2.24 through 15.1.6 behind a CDN should upgrade or strip a header. Next.js has a low severity cache poisoning vulnerability, published as CVE-2025-32421 and reported by [Vercel]() in [its changelog](). It affects Next.js versions 14.2.24 through 15.1.6 and is a bypass of the earlier CVE-2024-46982. The issue is a race condition between two requests: one with the ?\_\_nextDataRequest=1 query parameter and another with the x-now-route-matches header. Some CDN providers may cache a 200 OK response even without explicit cache-control headers. That lets the response body from a non-cacheable data request be served to later users on a normal request that keeps cacheable headers, such as Cache-Control: public, max-age=300. No backend access or privilege escalation is possible. Exploitation depends on precise timing and a vulnerable CDN configuration. The fix, in 15.1.6 and 14.2.24, strips the x-now-route-matches header from incoming requests. Applications hosted on Vercel are not affected, because the platform does not cache responses based only on a 200 OK status without explicit cache-control headers. Self-hosted deployments that cannot upgrade immediately have two workarounds: - Strip the x-now-route-matches header from all incoming requests at the CDN. - Set cache-control: no-store for all responses at risk. Vercel recommends caching only responses that carry explicit cache-control headers. The report credits Allam Rachid (zhero;) for the responsible disclosure, awarded under Vercel's bug bounty program. ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() [Original source]() [Read CVE-2025-32421 on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-32421