Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

The version of Next.js installed on the remote host is 15.1.x prior to 15.1.8. It is, therefore, affected by a cache poisoning vulnerability leading to a denial of service condition.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to     before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js.
    This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a     HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users     attempting to access the page. This issue has been addressed in version 15.1.8. (CVE-2025-49826)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to
    before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js.
    This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a
    HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users
    attempting to access the page. This issue has been addressed in version 15.1.8. (CVE-2025-49826)

ID	Name	Product	Family	Type	Severity
115788	Next.js 15.1.x < 15.1.8 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
260287	Linux Distros Unpatched Vulnerability : CVE-2025-49826	Nessus	Misc.	Local	high
428291	SCA: security update for next (GHSA-67rr-84xm-4c7r)	Tenable Cloud Security	SCA Checks	Local	high
428291	SCA: security update for next (GHSA-67rr-84xm-4c7r)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-49826

high

Tenable Plugins

high

high

high

high