Next.js Cache Poisoning Vulnerability Let Attackers Trigger DoS Condition
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Key Takeaways<\/strong>
<\/mark>1. Next.js versions 15.1.0-15.1.8 have a cache poisoning bug causing DoS attacks through blank page delivery.
2. Needs affected Next.js version + ISR with cache revalidation + SSR with CDN caching 204 responses.
3. Race condition allows HTTP 204 responses to be cached for static pages, serving empty content to all users.
4. Update to Next.js 15.1.8+ immediately - the vulnerability is fully patched.<\/pre>\nA critical security vulnerability identified as CVE-2025-49826 has been discovered in Next.js, the popular React-based web framework, allowing attackers to exploit cache poisoning mechanisms to trigger Denial of Service (DoS) conditions.\u00a0<\/p>\n
The vulnerability, reported by security researchers Allam Rachid (zhero) and Allam Yasser (inzo_), affects Next.js versions ranging from 15.1.0 to 15.1.8, prompting immediate security updates from the development team.<\/p>\n
Next.js DoS Vulnerability<\/strong><\/h2>\n
The vulnerability stems from a cache poisoning<\/a> bug that manipulates the framework\u2019s response caching mechanism, specifically targeting HTTP 204 responses in static page rendering.\u00a0<\/p>\n
Under specific conditions, the flaw allows malicious actors to poison the cache with empty responses, causing legitimate users to receive blank pages instead of proper content.<\/p>\n
For the vulnerability to be exploitable, three critical conditions must be met simultaneously: deployment of an affected Next.js version (>=15.1.0 <15.1.8), utilization of Incremental Static Regeneration (ISR) with cache revalidation in production mode (next start or standalone deployment), and implementation of Server-Side Rendering (SSR) with a Content Delivery Network (CDN) configured to cache 204 responses.<\/p>\n
The attack vector exploits a race condition in Next.js\u2019s shared response object mechanism, where the framework incorrectly processes and caches HTTP 204 status codes.\u00a0<\/p>\n
When successfully executed, this cache poisoning technique results in persistent DoS conditions, as the cached empty response gets served to all subsequent users attempting to access the affected static pages.\u00a0<\/p>\n
The vulnerability\u2019s impact is particularly severe for high-traffic applications relying on ISR for performance optimization.<\/p>\n
\n