Executive brief
Next.js is a popular web framework used to build fast, scalable web applications. A vulnerability in affected versions allows attackers to poison the application's cache, causing HTTP 204 (No Content) responses to be incorrectly cached and served to all users, resulting in a denial of service where legitimate pages appear unavailable or blank.
Technical details
This vulnerability is a cache poisoning issue (CWE-444) affecting Next.js versions 15.0.4 through 15.1.8. The flaw allows HTTP 204 responses to be cached for static pages under certain conditions, causing the empty response to be served to all subsequent users instead of the correct page content. The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. An attacker can trigger this condition to cause a persistent denial of service by polluting the cache with incorrect responses. The issue has been patched in versions 15.1.8 and later, as well as in versions 15.0.4 and earlier.
Affected products
- Vercel Next.js 15.0.4 through 15.1.7
Timeline
- 2025-07-03: disclosed
- 2025-07-03: patched: Fixed in versions 15.1.8 and 15.2.0+