UpHeron
All vulnerabilities

npm

CVE-2025-49005

Next.js has a Cache poisoning vulnerability due to omission of the Vary header

Severity
Low 3.7
Published
3 Jul 2025
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.3.3
Also known as
GHSA-r2fc-ccr8-96c4
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 15.3.0 before 15.3.3

References