Input validation error in Next.js - CVE-2025-49005
Published: July 4, 2025
Vulnerability identifier: #VU112179
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]
CVE-ID: CVE-2025-49005
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a cache poisoning attack.
The vulnerability exists due to omission of Vary HTTP header when creating cache data in App Router. A remote attacker can force the application to cache RSC payloads and serve them in place of HTML code under specific conditions involving middleware and redirects.
Affected software
Next.js
How to mitigate CVE-2025-49005
Install updates from vendor's website.
Next.js - update to 15.3.3
External References
- https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
- https://github.com/vercel/next.js/issues/79346
- https://github.com/vercel/next.js/releases/tag/v15.3.3
- https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
- https://vercel.com/changelog/cve-2025-49005