7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49826

CVE-2025-49826: Next.JS vulnerability can lead to DoS via cache poisoning

Summary

A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page

More details: CVE-2025-49826

Credits

Allam Rachid zhero;
Allam Yasser (inzo)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49826

CVE-2025-49826:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 15.0.4-canary.51, < 15.1.8	15.1.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cache poisoning issue in Next.js that leads to a Denial of Service. The root cause is the improper handling of HTTP 204 No Content responses for React Server Component (RSC) prefetch requests.

The analysis of the provided patches reveals two main areas of concern:

Client-Side Cache Handling: The functions fetchRouteOnCacheMiss and fetchSegmentEntryOnCacheMiss in packages/next/src/client/components/segment-cache/cache.ts were not treating 204 responses as cache misses. This meant that if the server responded with a 204, the client-side cache could store this as a valid response for a page or segment, effectively making it inaccessible.
Server-Side Response Generation: The request handling logic within the Server class in packages/next/src/server/base-server.ts was not consistently returning a 204 status code for prefetch requests that resulted in a cache miss. This inconsistent behavior is what triggered the client-side issue. The patch ensures that for RSC prefetch requests that miss the cache, the server reliably returns a 204 status code.

By fixing both the client-side handling and the server-side response, the patches prevent the cache poisoning from occurring. The vulnerable functions are those that were involved in this faulty request-response cycle for prefetched content.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.