# CVE-2025-49826 By Steven Van · 2025-07-03 A Next.js cache poisoning bug in versions 15.1.0 to 15.1.8 could serve a cached 204 response to all visitors of a page. Vercel patched a Next.js cache poisoning bug affecting versions **15.1.0 up to 15.1.8**, tracked as [CVE-2025-49826](). Under specific conditions, an HTTP 204 response could get cached for a static page and then served to every visitor of that page, a denial of service condition. Vercel says the bug did not affect customers hosted on Vercel. Exploiting it required all of the following: an affected Next.js version, a route using cache revalidation with ISR (via next start or standalone mode), and a route using SSR behind a CDN configured to cache 204 responses. The fix removes the code path that could set a 204 response and eliminates a race condition by no longer relying on a shared response object to populate the Next.js response cache. Vercel credited Allam Rachid (zhero) and Allam Yasser (inzo\_) for the responsible disclosure. ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() [Original source]() [Read CVE-2025-49826 on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-49826