Executive brief
Next.js is a React-based web framework used to build server-rendered and static web applications. A cache poisoning vulnerability in Next.js App Router allows an attacker to poison HTTP caches by causing RSC (React Server Component) payloads to be cached and served as HTML to subsequent users, resulting in incorrect page content delivery and potential data integrity issues. The vulnerability only affects versions 15.3.0 through 15.3.2 and requires specific conditions involving middleware and redirects to be exploited.
Technical details
The vulnerability is a cache poisoning issue (CWE-444) in Next.js App Router versions 15.3.0 through 15.3.2 caused by omission of the Vary header in HTTP responses. Under specific conditions involving middleware and redirects, RSC (React Server Component) payloads can be cached by intermediary HTTP caches and served in place of expected HTML content to subsequent requests. This occurs because the missing Vary header prevents caches from properly differentiating between requests that should return different content types. An attacker with network access can trigger this condition to poison shared caches, affecting all users receiving content from the poisoned cache. The vulnerability requires specific application configuration (middleware and redirects) to be exploited. The fix is available in Next.js 15.3.3 and later versions, which properly include the Vary header to prevent cache poisoning.
Affected products
- Vercel Next.js >=15.3.0, <15.3.3
Timeline
- 2025-07-03: disclosed
- 2025-07-03: patched: Fix released in Next.js 15.3.3