Next.js EUVD-2025-19911

| CVE-2025-49005 LOW
HTTP Request/Response Smuggling (CWE-444)
2025-07-03 [email protected] GHSA-r2fc-ccr8-96c4
Information Disclosure
3.7
CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Mar 16, 2026 - 02:12 vuln.today
EUVD ID Assigned
Mar 16, 2026 - 02:12 euvd
EUVD-2025-19911
Patch released
Mar 16, 2026 - 02:12 nvd
Patch available
PoC Detected
Sep 10, 2025 - 19:14 vuln.today
Public exploit code
CVE Published
Jul 03, 2025 - 21:15 nvd
LOW 3.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 29 npm packages depend on next (27 direct, 2 indirect)

Ecosystem-wide dependent count for version 15.3.0.

DescriptionNVD

Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

Analysis

Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

Technical ContextAI

This vulnerability is classified as HTTP Request/Response Smuggling (CWE-444).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

Share

EUVD-2025-19911 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy