修复版本
14.2.25
15.0.1
14.2.24
CVE-2025-32421 describes a low-severity race condition vulnerability discovered in Next.js. This flaw, reported by Allam Rachid (zhero), can lead to misconfigured Pages Router endpoints serving pageProps data instead of standard HTML. The vulnerability impacts versions of Next.js prior to 14.2.24 and has been resolved with the release of version 14.2.24.
The primary impact of CVE-2025-32421 is the potential for unexpected behavior in Next.js applications. An attacker, exploiting a misconfigured Pages Router, could potentially manipulate the data served to users, leading to incorrect rendering or unexpected application state. While the severity is rated LOW, this could still lead to user confusion or, in more complex scenarios, potential data integrity issues. The vulnerability does not appear to enable remote code execution or direct data theft, but the misrepresentation of data could be leveraged in social engineering attacks or to disrupt application functionality.
CVE-2025-32421 was publicly disclosed on 2025-05-15. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability was discovered and responsibly disclosed by Allam Rachid (zhero) as part of the Next.js bug bounty program. Its low severity and lack of public exploits suggest a low probability of exploitation.
Applications utilizing the Next.js Pages Router, particularly those with custom routing configurations or deployments that deviate from standard Next.js practices, are at increased risk. Developers who have not upgraded to the latest version of Next.js are also potentially vulnerable.
• nodejs: Monitor application logs for unusual pageProps data being served instead of standard HTML.
grep 'pageProps' /path/to/your/app/logs/*.log• nodejs: Check Next.js configuration files for misconfigurations in the Pages Router.
• generic web: Use curl to test endpoints and verify that they return expected HTML content.
curl -I https://your-nextjs-app.com/your-endpointdisclosure
漏洞利用状态
EPSS
0.36% (58% 百分位)
CISA SSVC
CVSS 向量
The recommended mitigation for CVE-2025-32421 is to upgrade to Next.js version 14.2.24 or later. This version includes a fix that addresses the race condition. If upgrading is not immediately feasible, carefully review your Pages Router configuration to ensure it adheres to best practices and avoids the specific misconfigurations that trigger the vulnerability. Consider implementing stricter input validation and output sanitization to further reduce the potential impact of this vulnerability. After upgrade, confirm the fix by testing endpoints that previously exhibited the described behavior.
Actualice Next.js a la versión 14.2.24 o superior, o a la versión 15.1.6 o superior. Si no puede actualizar inmediatamente, mitigue la vulnerabilidad eliminando el encabezado `x-now-route-matches` de todas las solicitudes entrantes en la red de entrega de contenido y estableciendo `cache-control: no-store` para todas las respuestas en riesgo. Se recomienda encarecidamente almacenar en caché solo las respuestas con encabezados `cache-control` explícitos.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-32421 is a low-severity race condition in Next.js affecting the Pages Router. It can cause endpoints to serve pageProps data instead of standard HTML, potentially leading to unexpected application behavior.
You are affected if you are using a version of Next.js prior to 14.2.24 and have misconfigured the Pages Router. Review your configuration and upgrade to mitigate.
Upgrade to Next.js version 14.2.24 or later. Review and correct any misconfigurations in your Pages Router setup.
Currently, there are no known public exploits or active campaigns targeting CVE-2025-32421. However, it's still important to apply the fix.
You can find the official advisory on the Vercel changelog: https://vercel.com/changelog/cve-2025-32421
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。