Next.js Race Condition to Cache Poisoning
traduzindo…Plataforma
nodejs
Componente
next
Corrigido em
14.2.25
15.0.1
14.2.24
CVE-2025-32421 describes a low-severity race condition vulnerability discovered in Next.js. This flaw, reported by Allam Rachid (zhero), can lead to misconfigured Pages Router endpoints serving pageProps data instead of standard HTML. The vulnerability impacts versions of Next.js prior to 14.2.24 and has been resolved with the release of version 14.2.24.
Impacto e Cenários de Ataquetraduzindo…
The primary impact of CVE-2025-32421 is the potential for unexpected behavior in Next.js applications. An attacker, exploiting a misconfigured Pages Router, could potentially manipulate the data served to users, leading to incorrect rendering or unexpected application state. While the severity is rated LOW, this could still lead to user confusion or, in more complex scenarios, potential data integrity issues. The vulnerability does not appear to enable remote code execution or direct data theft, but the misrepresentation of data could be leveraged in social engineering attacks or to disrupt application functionality.
Contexto de Exploraçãotraduzindo…
CVE-2025-32421 was publicly disclosed on 2025-05-15. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability was discovered and responsibly disclosed by Allam Rachid (zhero) as part of the Next.js bug bounty program. Its low severity and lack of public exploits suggest a low probability of exploitation.
Quem Está em Riscotraduzindo…
Applications utilizing the Next.js Pages Router, particularly those with custom routing configurations or deployments that deviate from standard Next.js practices, are at increased risk. Developers who have not upgraded to the latest version of Next.js are also potentially vulnerable.
Passos de Detecçãotraduzindo…
• nodejs: Monitor application logs for unusual pageProps data being served instead of standard HTML.
grep 'pageProps' /path/to/your/app/logs/*.log• nodejs: Check Next.js configuration files for misconfigurations in the Pages Router.
• generic web: Use curl to test endpoints and verify that they return expected HTML content.
curl -I https://your-nextjs-app.com/your-endpointLinha do Tempo do Ataque
- Disclosure
disclosure
Inteligência de Ameaças
Status do Exploit
EPSS
0.36% (percentil 58%)
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Alta — exige condição de corrida, configuração não padrão ou circunstâncias específicas.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Baixo — acesso parcial ou indireto a alguns dados.
- Integrity
- Nenhum — sem impacto na integridade.
- Availability
- Nenhum — sem impacto na disponibilidade.
Software Afetado
Informações do pacote
- Última atualização
- 16.2.6recentemente
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The recommended mitigation for CVE-2025-32421 is to upgrade to Next.js version 14.2.24 or later. This version includes a fix that addresses the race condition. If upgrading is not immediately feasible, carefully review your Pages Router configuration to ensure it adheres to best practices and avoids the specific misconfigurations that trigger the vulnerability. Consider implementing stricter input validation and output sanitization to further reduce the potential impact of this vulnerability. After upgrade, confirm the fix by testing endpoints that previously exhibited the described behavior.
Como corrigirtraduzindo…
Actualice Next.js a la versión 14.2.24 o superior, o a la versión 15.1.6 o superior. Si no puede actualizar inmediatamente, mitigue la vulnerabilidad eliminando el encabezado `x-now-route-matches` de todas las solicitudes entrantes en la red de entrega de contenido y estableciendo `cache-control: no-store` para todas las respuestas en riesgo. Se recomienda encarecidamente almacenar en caché solo las respuestas con encabezados `cache-control` explícitos.
Boletim de Segurança CVE
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
Perguntas frequentestraduzindo…
What is CVE-2025-32421 — Race Condition in Next.js?
CVE-2025-32421 is a low-severity race condition in Next.js affecting the Pages Router. It can cause endpoints to serve pageProps data instead of standard HTML, potentially leading to unexpected application behavior.
Am I affected by CVE-2025-32421 in Next.js?
You are affected if you are using a version of Next.js prior to 14.2.24 and have misconfigured the Pages Router. Review your configuration and upgrade to mitigate.
How do I fix CVE-2025-32421 in Next.js?
Upgrade to Next.js version 14.2.24 or later. Review and correct any misconfigurations in your Pages Router setup.
Is CVE-2025-32421 being actively exploited?
Currently, there are no known public exploits or active campaigns targeting CVE-2025-32421. However, it's still important to apply the fix.
Where can I find the official Next.js advisory for CVE-2025-32421?
You can find the official advisory on the Vercel changelog: https://vercel.com/changelog/cve-2025-32421
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.