CVE-2025-49826

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.4-canary.51 through 15.1.7

Description Next.js is susceptible to a cache poisoning issue that can lead to a Denial of Service (DoS) condition. This flaw allows attackers to manipulate the caching of HTTP responses, potentially serving cached HTTP 204 responses for static pages to all users, rendering the pages inaccessible. The issue impacts self-hosted deployments but does not affect customers hosted on Vercel.

Recommendations Update to Next.js version 15.1.8 or later.