Vercel Next.js: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2025-49826

  Next.js DoS vulnerability via cache poisoning

  Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on V…

  vercel next.js next npm
  Jul 3, 2025
• Low 3.7
  CVE-2025-49005

  Next.js cache poisoning due to omission of Vary header

  Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to retu…

  vercel next.js jitsucom-jitsu-console next Wolfi npm
  Jul 3, 2025

Revision history

1. 2025-07-03 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-67rr-84xm-4c7r vom 2025-07-03
  https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
• GitHub Security Advisory GHSA-r2fc-ccr8-96c4 vom 2025-07-03
  https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4