CVE-2025-49005
1 advisory.
npm/next CVE-2025-49005: low 3.7
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
Action: Upgrade next to 15.3.3 or later.
npm i next@15.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 15.3.0 | 15.3.3 | - |
Fixed versions
| 15.3.3 |
Sources
- osv: GHSA-r2fc-ccr8-96c4
- https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
- https://nvd.nist.gov/vuln/detail/CVE-2025-49005
- https://github.com/vercel/next.js/issues/79346
- https://github.com/vercel/next.js/pull/79939
- https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.3.3
- https://vercel.com/changelog/cve-2025-49005
CVE-2025-49005 · published · modified · JSON