GHSA-qpjv-v59x-3qc4

Next.js Race Condition to Cache Poisoning

Source: GitHub Advisory Database (reviewed) Low CVE-2025-32421

Packages

Ecosystem	Package	Affected	Fixed in
npm	next	>= 0.9.9, < 14.2.24	14.2.24
npm	next	>= 15.0.0, < 15.1.6	15.1.6

Details

As written in the advisory (Markdown source, shown as plain text).

**Summary** We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. [Learn more here](https://vercel.com/changelog/cve-2025-32421) **Credit** Thank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.

References

External links from the advisory. They lead to third-party sites.

https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4 web
https://nvd.nist.gov/vuln/detail/CVE-2025-32421 advisory
https://github.com/vercel/next.js package
https://vercel.com/changelog/cve-2025-32421 web