Platform
nodejs
Component
next
Fixed in
14.2.25
15.0.1
14.2.24
CVE-2025-32421 describes a low-severity race condition vulnerability discovered in Next.js. This flaw, reported by Allam Rachid (zhero), can lead to misconfigured Pages Router endpoints serving pageProps data instead of standard HTML. The vulnerability impacts versions of Next.js prior to 14.2.24 and has been resolved with the release of version 14.2.24.
The primary impact of CVE-2025-32421 is the potential for unexpected behavior in Next.js applications. An attacker, exploiting a misconfigured Pages Router, could potentially manipulate the data served to users, leading to incorrect rendering or unexpected application state. While the severity is rated LOW, this could still lead to user confusion or, in more complex scenarios, potential data integrity issues. The vulnerability does not appear to enable remote code execution or direct data theft, but the misrepresentation of data could be leveraged in social engineering attacks or to disrupt application functionality.
CVE-2025-32421 was publicly disclosed on 2025-05-15. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability was discovered and responsibly disclosed by Allam Rachid (zhero) as part of the Next.js bug bounty program. Its low severity and lack of public exploits suggest a low probability of exploitation.
Exploit Status
EPSS
0.36% (58% percentile)
CISA SSVC
CVSS Vector
The recommended mitigation for CVE-2025-32421 is to upgrade to Next.js version 14.2.24 or later. This version includes a fix that addresses the race condition. If upgrading is not immediately feasible, carefully review your Pages Router configuration to ensure it adheres to best practices and avoids the specific misconfigurations that trigger the vulnerability. Consider implementing stricter input validation and output sanitization to further reduce the potential impact of this vulnerability. After upgrade, confirm the fix by testing endpoints that previously exhibited the described behavior.
Update Next.js to version 14.2.24 or higher, or to version 15.1.6 or higher. If you cannot update immediately, mitigate the vulnerability by removing the `x-now-route-matches` header from all incoming requests in the content delivery network and setting `cache-control: no-store` for all responses at risk. It is strongly recommended to only cache responses with explicit `cache-control` headers.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-32421 is a low-severity race condition in Next.js affecting the Pages Router. It can cause endpoints to serve pageProps data instead of standard HTML, potentially leading to unexpected application behavior.
You are affected if you are using a version of Next.js prior to 14.2.24 and have misconfigured the Pages Router. Review your configuration and upgrade to mitigate.
Upgrade to Next.js version 14.2.24 or later. Review and correct any misconfigurations in your Pages Router setup.
Currently, there are no known public exploits or active campaigns targeting CVE-2025-32421. However, it's still important to apply the fix.
You can find the official advisory on the Vercel changelog: https://vercel.com/changelog/cve-2025-32421
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.