Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0     to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The     issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead     under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not     lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache     poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has     been resolved in Next.js 15.3.3. (CVE-2025-49005)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0
    to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The
    issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead
    under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not
    lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache
    poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has
    been resolved in Next.js 15.3.3. (CVE-2025-49005)

ID	Name	Product	Family	Severity
260206	Linux Distros Unpatched Vulnerability : CVE-2025-49005	Nessus	Misc.	low
428292	SCA: security update for next (GHSA-r2fc-ccr8-96c4)	Tenable Cloud Security	SCA Checks	low
428292	SCA: security update for next (GHSA-r2fc-ccr8-96c4)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2025-49005

low

Tenable Plugins

low

low

low