low3.7
CVE-2025-32421
Next.js Race Condition to Cache Poisoning
Impact
**Summary** We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. [Learn more here](https://vercel.com/changelog/cve-2025-32421) **Credit** Thank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | next | >= 15.0.0, < 15.1.6 | 15.1.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vercel | Next.Js | before 14.2.24 from 15.0.0 before 15.1.6 |