Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and     15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain     misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue     was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming     requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does     not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who     self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by     stripping the `x-now-route-matches` header from all incoming requests at the content development network     and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly     recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and
    15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain
    misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue
    was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming
    requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does
    not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who
    self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by
    stripping the `x-now-route-matches` header from all incoming requests at the content development network
    and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly
    recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)

ID	Name	Product	Family	Severity
260286	Linux Distros Unpatched Vulnerability : CVE-2025-32421	Nessus	Misc.	low
425970	SCA: security update for next (GHSA-qpjv-v59x-3qc4)	Tenable Cloud Security	SCA Checks	low
425970	SCA: security update for next (GHSA-qpjv-v59x-3qc4)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2025-32421

low

Tenable Plugins

low

low

low