Platform
nodejs
Component
next
Opgelost in
14.2.25
15.0.1
14.2.24
CVE-2025-32421 describes a low-severity race condition vulnerability discovered in Next.js. This flaw, reported by Allam Rachid (zhero), can lead to misconfigured Pages Router endpoints serving pageProps data instead of standard HTML. The vulnerability impacts versions of Next.js prior to 14.2.24 and has been resolved with the release of version 14.2.24.
The primary impact of CVE-2025-32421 is the potential for unexpected behavior in Next.js applications. An attacker, exploiting a misconfigured Pages Router, could potentially manipulate the data served to users, leading to incorrect rendering or unexpected application state. While the severity is rated LOW, this could still lead to user confusion or, in more complex scenarios, potential data integrity issues. The vulnerability does not appear to enable remote code execution or direct data theft, but the misrepresentation of data could be leveraged in social engineering attacks or to disrupt application functionality.
CVE-2025-32421 was publicly disclosed on 2025-05-15. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability was discovered and responsibly disclosed by Allam Rachid (zhero) as part of the Next.js bug bounty program. Its low severity and lack of public exploits suggest a low probability of exploitation.
Applications utilizing the Next.js Pages Router, particularly those with custom routing configurations or deployments that deviate from standard Next.js practices, are at increased risk. Developers who have not upgraded to the latest version of Next.js are also potentially vulnerable.
• nodejs: Monitor application logs for unusual pageProps data being served instead of standard HTML.
grep 'pageProps' /path/to/your/app/logs/*.log• nodejs: Check Next.js configuration files for misconfigurations in the Pages Router.
• generic web: Use curl to test endpoints and verify that they return expected HTML content.
curl -I https://your-nextjs-app.com/your-endpointdisclosure
Exploit Status
EPSS
0.36% (58% percentiel)
CISA SSVC
CVSS-vector
The recommended mitigation for CVE-2025-32421 is to upgrade to Next.js version 14.2.24 or later. This version includes a fix that addresses the race condition. If upgrading is not immediately feasible, carefully review your Pages Router configuration to ensure it adheres to best practices and avoids the specific misconfigurations that trigger the vulnerability. Consider implementing stricter input validation and output sanitization to further reduce the potential impact of this vulnerability. After upgrade, confirm the fix by testing endpoints that previously exhibited the described behavior.
Actualice Next.js a la versión 14.2.24 o superior, o a la versión 15.1.6 o superior. Si no puede actualizar inmediatamente, mitigue la vulnerabilidad eliminando el encabezado `x-now-route-matches` de todas las solicitudes entrantes en la red de entrega de contenido y estableciendo `cache-control: no-store` para todas las respuestas en riesgo. Se recomienda encarecidamente almacenar en caché solo las respuestas con encabezados `cache-control` explícitos.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2025-32421 is a low-severity race condition in Next.js affecting the Pages Router. It can cause endpoints to serve pageProps data instead of standard HTML, potentially leading to unexpected application behavior.
You are affected if you are using a version of Next.js prior to 14.2.24 and have misconfigured the Pages Router. Review your configuration and upgrade to mitigate.
Upgrade to Next.js version 14.2.24 or later. Review and correct any misconfigurations in your Pages Router setup.
Currently, there are no known public exploits or active campaigns targeting CVE-2025-32421. However, it's still important to apply the fix.
You can find the official advisory on the Vercel changelog: https://vercel.com/changelog/cve-2025-32421
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.