What is the CVSS score of CVE-2025-32421?

CVE-2025-32421 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Next.js are affected by CVE-2025-32421?

CVE-2025-32421 is a low-severity vulnerability in Next.js (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-32421?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Next.js CVE-2025-32421

LOW

Race Condition (CWE-362)

2025-05-14 security-advisories@github.com

Information Disclosure Race Condition Next.js Vercel

3.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:41 vuln.today

CVE Published

May 14, 2025 - 23:15 nvd

LOW 3.7

DescriptionGitHub Advisory

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the x-now-route-matches header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on 200 OK status without explicit cache-control headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the x-now-route-matches header from all incoming requests at the content development network and setting cache-control: no-store for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.

AnalysisAI

Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-362. Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the x-now-route-matches header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on 200 OK status without explicit cache-control headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the x-now-route-matches header from all incoming requests at the content development network and setting cache-control: no-store for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers. Affected products include: Vercel Next.Js. Version information: prior to 14.2.24.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.