The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and     15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain     misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue     was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming     requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does     not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who     self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by     stripping the `x-now-route-matches` header from all incoming requests at the content development network     and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly     recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-32421

low Nessus Plugin ID 260286

Version 1.2

Version 1.1

Version 1.2 Nov 7, 2026, 4:01 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:U/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611070401
Version 1.1 Sep 2, 2025, 6:30 AM New Plugin Feed: 202509020630