{"action":"Upgrade next to 15.1.8 or later.","affected":[{"fixed":"15.1.8","introduced":"15.0.4-canary.51"}],"component":"next","cve_ids":["CVE-2025-49826"],"ecosystem":"npm","epss":0.01133,"exploited":false,"fixed_versions":["15.1.8"],"ghsa_id":"GHSA-67rr-84xm-4c7r","id":"tcs_01M5KF66MME1TBPXTYEXEX6MKA","modified_at":"2025-07-03T21:49:52Z","published_at":"2025-07-03T21:14:48Z","references":["https://osv.dev/vulnerability/GHSA-67rr-84xm-4c7r","https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r","https://nvd.nist.gov/vuln/detail/CVE-2025-49826","https://github.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2","https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.1.8","https://vercel.com/changelog/cve-2025-49826"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-67rr-84xm-4c7r","url":"https://osv.dev/vulnerability/GHSA-67rr-84xm-4c7r"}],"summary":"Next.JS vulnerability can lead to DoS via cache poisoning"}