CVE-2025-49005 — Next.js cache poisoning due to omission of Vary header

Back Back to CVE browser

LOW

Next.js cache poisoning due to omission of Vary header

Published Jul 3, 2025

3.7

LOW

CVSS 3.1

EPSS 0.46%

Description

Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

Affected products

Vendor Vercel Product Next.js Default
n/a
- Version
  >= 15.3.0, < 15.3.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vercel

Next.js

n/a

Version	Status	Constraints
>= 15.3.0, < 15.3.3	affected	-

Red Hat Enterprise Linux 10

firefox

Fix deferred
Red Hat Enterprise Linux 10

thunderbird

Fix deferred
Red Hat Enterprise Linux 7

firefox

Fix deferred
Red Hat Enterprise Linux 8

firefox

Fix deferred
Red Hat Enterprise Linux 8

thunderbird

Fix deferred
Red Hat Enterprise Linux 9

dotnet7.0

Fix deferred
Red Hat Enterprise Linux 9

firefox

Fix deferred
Red Hat Enterprise Linux 9

thunderbird

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/docling-serve-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-3.1-8b-lab-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-3.1-8b-starter-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-7b-redhat-lab

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-7b-starter

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-8b-code-base

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-8b-code-instruct

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-8b-lab-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-8b-lab-v2-preview

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/granite-8b-starter-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/knowledge-adapter-v3

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/mixtral-8x7b-instruct-v0-1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-docling-layout

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-docling-tableformer

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-3-1-8b-lab-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-3-1-8b-starter-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-7b-redhat-lab

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-7b-starter

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-8b-code-base

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-8b-code-instruct

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-8b-lab-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-8b-lab-v2-preview

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-granite-8b-starter-v1

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-knowledge-adapter-v3

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/modelcar-skills-adapter-v3

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/pathservice-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/prometheus-8x7b-v2-0

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/skills-adapter-v3

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)

rhelai1/ui-rhel9

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 10	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 7	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	dotnet7.0	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/docling-serve-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-3.1-8b-lab-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-3.1-8b-starter-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-7b-redhat-lab	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-7b-starter	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-8b-code-base	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-8b-code-instruct	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-8b-lab-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-8b-lab-v2-preview	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/granite-8b-starter-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/knowledge-adapter-v3	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/mixtral-8x7b-instruct-v0-1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-docling-layout	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-docling-tableformer	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-3-1-8b-lab-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-3-1-8b-starter-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-7b-redhat-lab	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-7b-starter	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-8b-code-base	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-8b-code-instruct	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-8b-lab-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-8b-lab-v2-preview	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-granite-8b-starter-v1	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-knowledge-adapter-v3	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/modelcar-skills-adapter-v3	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/pathservice-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/prometheus-8x7b-v2-0	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/skills-adapter-v3	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI)	rhelai1/ui-rhel9	Fix deferred	n/a

Ecosystem	Package	Introduced	Fixed
npm	next	15.3.0	15.3.3

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.46% 0.00457

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00457

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.46% (0.00457)	37.42th	v5 (v2026.06.15)
Jun 15, 2026	0.40% (0.00403)	31.81th	v5 (v2026.06.15)
Jul 4, 2025	0.03% (0.00031)	7.18th	v4 (v2025.03.14)

Weaknesses (1)

CWE-444

References (11)

https://access.redhat.com/security/cve/CVE-2025-49005
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2376222
Issue Tracking
https://github.com/advisories/GHSA-r2fc-ccr8-96c4
Advisory
https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
x_refsource_MISCPatch
https://github.com/vercel/next.js/issues/79346
exploitx_refsource_MISCIssue Tracking
https://github.com/vercel/next.js/pull/79939
https://github.com/vercel/next.js/releases/tag/v15.3.3
x_refsource_MISCRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49005
https://vercel.com/changelog/cve-2025-49005
x_refsource_MISCVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-49005

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-49005		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2376222		Issue Tracking
https://github.com/advisories/GHSA-r2fc-ccr8-96c4		Advisory
https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066		x_refsource_MISCPatch
https://github.com/vercel/next.js/issues/79346		exploitx_refsource_MISCIssue Tracking
https://github.com/vercel/next.js/pull/79939
https://github.com/vercel/next.js/releases/tag/v15.3.3		x_refsource_MISCRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49005
https://vercel.com/changelog/cve-2025-49005		x_refsource_MISCVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-49005