Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.

The version of Next.js installed on the remote host is prior to 14.2.24 or 15.x prior to 15.1.6. It is, therefore, affected by a race condition vulnerability in the Pages Router which, under certain misconfigurations, can cause normal endpoints to serve pageProps data instead of standard HTML, leading to cache poisoning.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and     15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain     misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue     was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming     requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does     not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who     self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by     stripping the `x-now-route-matches` header from all incoming requests at the content development network     and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly     recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and
    15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain
    misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue
    was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming
    requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does
    not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who
    self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by
    stripping the `x-now-route-matches` header from all incoming requests at the content development network
    and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly
    recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)

ID	Name	Product	Family	Type	Severity
115790	Next.js 15.x < 15.1.6 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	low
115789	Next.js 9.5.0 < 14.2.24 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	low
260286	Linux Distros Unpatched Vulnerability : CVE-2025-32421	Nessus	Misc.	Local	low
425970	SCA: security update for next (GHSA-qpjv-v59x-3qc4)	Tenable Cloud Security	SCA Checks	Local	low
425970	SCA: security update for next (GHSA-qpjv-v59x-3qc4)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-32421

low

Tenable Plugins

low

low

low

low

low