CVE-2025-32421
Description
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.
How to fix
- vercel next.js14.2.24, 15.1.6 or later
- next14.2.24, 15.1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vercel next.js | v < 14.2.24, 15.0.0 ≤ v < 15.1.6 | 14.2.24, 15.1.6 |
| nextnpm | 0.9.9 ≤ v < 14.2.24, 15.0.0 ≤ v < 15.1.6 | 14.2.24, 15.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.