CVE-2025-49005: 
NixOS vulnerability analysis and mitigation

CVE-2025-49005 is a cache poisoning vulnerability in Next.js App Router caused by the omission of the Vary HTTP response header. Affecting Next.js versions 15.3.0 through 15.3.3 (exclusive) and Vercel CLI versions 41.4.1 through 42.2.0, the flaw allows React Server Component (RSC) payloads to be cached and served in place of expected HTML content under specific conditions involving middleware and redirects. The vulnerability was published on July 3, 2025, and has a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Vercel Changelog).

The root cause is the omission of the Vary header (CWE-444 — Inconsistent Interpretation of HTTP Requests) in Next.js App Router responses for certain route types. A prior change (#77797) had intentionally skipped setting the Vary header for "basic routes" under the assumption that the _rsc query parameter would serve as a sufficient cache differentiator. However, when middleware performs a redirect, the _rsc query parameter is dropped, causing the browser or CDN to cache an RSC payload (text/x-component) under the same cache key as the HTML response. The fix (commit ec202ec) reinstates the Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch header to ensure caches correctly distinguish between RSC and HTML responses (GitHub Issue, Fix Commit).

The primary impact is an integrity violation where users may receive a raw RSC payload (text/x-component) instead of rendered HTML, resulting in a broken or unreadable page experience. On Vercel-hosted deployments, the impact is limited to the browser cache (e.g., bfcache restores or reopened tabs) and does not poison the CDN. On self-hosted or externally deployed instances, CDNs that do not properly differentiate between RSC and HTML cache keys may serve the corrupted RSC response to all users, effectively poisoning the shared cache. There is no confidentiality or availability impact; the vulnerability is limited to low-severity integrity degradation (Github Advisory, Vercel Changelog).

1. Identify a vulnerable deployment: Locate a Next.js App Router application running versions 15.3.0–15.3.2 that uses middleware with redirect logic and is self-hosted behind a CDN that does not distinguish RSC from HTML in cache keys.
2. Trigger an RSC prefetch request: Send a prefetch request to a page URL with the _rsc query parameter (e.g., GET /en?_rsc=xxxx) to initiate an RSC payload fetch.
3. Observe middleware redirect: The middleware processes the request but drops the _rsc query parameter during the redirect (e.g., redirecting /en?_rsc=xxxx to /), causing the server to respond with an RSC payload to the redirected URL.
4. Cache poisoning occurs: Because the response lacks a proper Vary header, the browser or CDN caches the RSC payload (text/x-component) under the plain URL (e.g., /), without differentiating it from the expected HTML response.
5. Subsequent users receive corrupted response: Any user (or the same user on tab reopen/bfcache restore) requesting the affected URL receives the cached RSC payload instead of HTML, resulting in a broken page (GitHub Issue, Github Advisory).

• Network: HTTP responses to standard page URLs (e.g., /, /en) with Content-Type: text/x-component instead of text/html; absence of Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch in response headers from Next.js App Router endpoints.
• Logs: CDN or proxy access logs showing cache HITs for RSC payloads (text/x-component) on URLs that should serve HTML; redirect chains where _rsc query parameter is present in the request but absent in the redirect target.
• Browser: Users reporting blank or garbled pages after reopening closed tabs or navigating back; browser DevTools showing cached responses with Content-Type: text/x-component for non-RSC page requests (GitHub Issue).

The primary remediation is to upgrade Next.js to version 15.3.3 or later, which reinstates the Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch header to prevent incorrect cache reuse. After upgrading, redeploy the application to ensure the fix takes effect and any poisoned cache entries are invalidated. For self-hosted deployments, additionally configure the CDN to include the RSC and Next-Router-* headers in cache key differentiation as an interim measure. Vercel CLI users should upgrade to version 42.2.0 or later (Github Advisory, Next.js v15.3.3 Release, Vercel Changelog).

Vercel published a changelog entry for CVE-2025-49005 on the day of disclosure (July 3, 2025), providing clear remediation guidance and deployment context (Vercel Changelog). The issue was originally reported by community researcher lujjjh via a GitHub issue with a public reproduction repository, demonstrating the practical impact in Chrome's bfcache behavior (GitHub Issue). Community reaction was generally measured given the Low severity rating, with the fix being a straightforward revert of a prior optimization. No significant media coverage or threat actor commentary has been observed.