Is CVE-2025-49826 actively exploited?

CVE-2025-49826 has no public evidence of in-the-wild exploitation as of 2025-09-10.

What is the CVSS score for CVE-2025-49826?

CVE-2025-49826 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How do I patch CVE-2025-49826?

Patch guidance is available from vercel security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-49826.

Fix CVE-2025-49826 - HIGH vercel next.js

Q: Which products are affected by CVE-2025-49826?

3 products: vercel next.js, vercel next.js, vercel next.js.

Description

Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-444

Metadata

Primary Vendor: VERCEL
Published: 7/3/2025
Last Modified: 9/10/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2025-49826

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary