# CVE-2025-49005 By Steven Van · 2025-07-03 A cache poisoning bug in Next.js App Router and Vercel CLI could serve RSC payloads as HTML; fixed in Next.js 15.3.3. A cache poisoning issue in Next.js App Router (versions 15.3.0 to below 15.3.3) and [Vercel]() CLI (41.4.1 to 42.2.0) has been fixed under [CVE-2025-49005](). Under specific conditions involving middleware redirects and omitted Vary headers, page requests for HTML could return a React Server Component (RSC) payload instead, which then got cached and could display broken or incorrect client content. The bug occurred when a middleware redirect stripped the framework's cache-busting parameter, breaking cache key separation between RSC and HTML responses. - On Vercel, the issue only affected the browser cache, not the CDN. - Self-hosted deployments could see CDN cache poisoning if their CDN doesn't distinguish RSC from HTML in cache keys. - Next.js 15.3.3 fixes this by correctly setting the Vary header to separate RSC and HTML responses. - Customers hosting on Vercel with an affected CLI version must redeploy to get the fix. - Until then, workarounds are to manually set **Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch** on RSC responses, or to apply a unique cache-busting search parameter to the middleware redirect destination. ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() [Original source]() [Read CVE-2025-49005 on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-49005