CVE-2025-49826: 
ASP.NET Core 脆弱性の分析と軽減

Next.js, a React framework for building full-stack web applications, was found to contain a cache poisoning vulnerability (CVE-2025-49826) affecting versions 15.0.4-canary.51 to before 15.1.8. The vulnerability was disclosed on July 3, 2025, and received a CVSS score of 7.5 (High). This security flaw could lead to a Denial of Service (DoS) condition through cache poisoning (NVD, Security Online).

The vulnerability stems from a cache revalidation logic issue in Incremental Static Regeneration (ISR). Under specific conditions, the flaw allows HTTP 204 responses to be cached for static pages, which are then served to all users attempting to access the page. The issue specifically affects routes using cache revalidation with ISR in next start or standalone mode, and routes using Server-Side Rendering (SSR) combined with a CDN that caches 204 responses (Vercel Advisory, Security Online).

When exploited, the vulnerability causes entire pages to fail to render properly across a site, effectively resulting in a service blackout for critical user-facing content. The issue leads to a 204 No Content response being erroneously cached and served to all users visiting the affected pages. Notably, this issue does not impact customers hosted on Vercel (Security Online, Vercel Advisory).

The issue has been patched in version 15.2.0 and backported to version 15.0.4. The fix removed the problematic code path responsible for setting 204 responses and addressed a potential race condition by eliminating reliance on a shared response object in cache logic. Organizations running self-hosted or on-prem versions of Next.js between 15.1.0 and 15.1.7 should upgrade immediately to version 15.2.0 or later (Security Online, Vercel Advisory).

The vulnerability was responsibly disclosed by security researchers Allam Rachid (zhero) and Allam Yasser (inzo). The Next.js team responded promptly by releasing patches and providing detailed technical information about the vulnerability (Vercel Advisory).