Executive brief
Next.js is a web framework used to build server-rendered and static websites. A race condition in the Pages Router can allow attackers to poison the cache under certain misconfigurations, causing endpoints to serve sensitive pageProps data as HTML instead of the intended response. This could expose internal data to unauthorized users.
Technical details
This vulnerability is a race condition (CWE-362) in Next.js's Pages Router cache handling that affects versions before 14.2.24 and 15.0.0–15.1.5. The flaw allows a timing window where concurrent requests can trigger improper cache state, causing normal endpoints to serve pageProps data instead of standard HTML. The vulnerability requires high attack complexity and specific misconfiguration; no privileges or user interaction are required, and it is reachable over the network. An attacker can trigger cache poisoning to leak sensitive pageProps data. Patches are available in Next.js 14.2.24, 15.1.6, and later.
Affected products
- Vercel Next.js before 14.2.24, 15.0.0 to 15.1.5
Timeline
- 2025-05-14: disclosed: Responsible disclosure received
- 2025-05-15: advisory: GHSA-qpjv-v59x-3qc4 published