CVE-2025-32421

Overview

Next.js is a React framework for building web applications.

CVE-2025-32421 is a vulnerability in Next.js that affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. The issue arises from a race condition between page and data requests, which, under certain misconfigured CDN caching scenarios, can lead to cache poisoning.

Per OWASP: Cache poisoning is an attack in which an adversary injects malicious or manipulated content into a cache—such as a CDN, reverse proxy, or web application cache—so that when legitimate clients later request that resource, they receive the poisoned content.

This issue affects all versions of Next.js less than 14.2.24 and 15.x versions less than 15.1.6.

‍

Details

Module Info

• Product: Next.js
• Affected packages: next
• Affected versions: <14.2.24, >=15.0.0 <15.1.6
• GitHub repository: https://github.com/vercel/next.js
• Published packages: https://www.npmjs.com/package/next
• Package manager: npm
• Fixed in: NES for Next.js v12.3.10

‍

Vulnerability Info

This Low-severity vulnerability is found in the main next package in the affected versions of the Next.js framework.

An attacker can exploit a timing issue and inject a ?__nextDataRequest=1 query parameter along with a forged x-now-route-matches header to trick the server into returning JSON data normally reserved for hydration. If this response is cached under the base route instead of the full URL, it can serve JSON to normal HTML visitors, disrupting client behavior or leaking data.

‍

Mitigation

Next.js v13 and older versions have reached End-of-Life and will not receive any updates to address this issue.

Fixes are available in the latest versions of 14 and 15.  For older versions or for all other vulnerabilities in versions earlier than 14, users should apply one of the following mitigations:=

Users of the affected components should apply one of the following mitigations:

• Migrate to the latest version of Next.js
• Leverage a commercial support partner like HeroDevs for post-EOL security support.
• For self-hosted Next.js deployments unable to upgrade immediately, Vercel recommends that you can mitigate this vulnerability by:
  
  • Stripping the x-now-route-matches header from all incoming requests at your CDN
  • Setting cache-control: no-store for all responses under risk

Credits

• Allam Rachid (zhero)

‍