« Volver al listado

CVE-2025-49826

Estado: AnalizadaAlta (7.5)—

Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de cache poisoning en aplicación web expuesta (AV:N, PR:N, UI:N): T1190. Impacto: negación de servicio por respuesta HTTP 204 cacheada (CWE-444, A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Vercel — Next.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49826",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49826",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-08T14:33:15.486231Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vercel",
          "product": "next.js",
          "versions": [
            {
              "status": "affected",
              "version": ">= 15.0.4-canary.51, < 15.1.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-03T21:15:27.287",
  "references": [
    {
      "url": "https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vercel/next.js/releases/tag/v15.1.8",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://vercel.com/changelog/cve-2025-49826",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8."
    },
    {
      "lang": "es",
      "value": "Next.js es un framework React para crear aplicaciones web full-stack. Desde la versión 15.0.4-canary.51 hasta la versión anterior a la 15.1.8, se detectó un error de envenenamiento de caché que provocaba una condición de denegación de servicio (DoS) en Next.js. Este problema no afecta a los clientes alojados en Vercel. En ciertas circunstancias, este problema puede permitir que se almacene en caché una respuesta HTTP 204 para páginas estáticas, lo que hace que la respuesta 204 se muestre a todos los usuarios que intentan acceder a la página. Este problema se ha solucionado en la versión 15.1.8."
    }
  ],
  "lastModified": "2026-06-17T09:31:57.767",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F50DAFB8-34A5-4452-8AF6-BAA3FD8B6C32",
              "versionEndExcluding": "15.1.8",
              "versionStartExcluding": "15.0.4"
            },
            {
              "criteria": "cpe:2.3:a:vercel:next.js:15.0.4:canary51:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBF83B84-0DA2-481D-B7AD-2D7021C21AE9"
            },
            {
              "criteria": "cpe:2.3:a:vercel:next.js:15.0.4:canary52:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28634725-9D9F-4C0D-BA06-EDD16FFF445F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}