What is CVE-2025-49005?

CVE-2025-49005 is a low-severity vulnerability in Vercel Next.js, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 3.7/10. Published 2025-07-03.

How severe is CVE-2025-49005?

Low severity. CVSS v3 base score is 3.7 out of 10.

Is CVE-2025-49005 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Vercel Next.js

CVE-2025-49005

Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.

Vulnerability class: HTTP Request Smuggling

Published 2025-07-03 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.005 (37.2th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000

Affected products

Vercel Next.js — versions >= 15.3.0, < 15.3.3
Vercel

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4 (Vendor Advisory)
github.com/vercel/next.js/issues/79346 (Exploit, Issue Tracking)
github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066 (Patch)
github.com/vercel/next.js/releases/tag/v15.3.3 (Release Notes)
vercel.com/changelog/cve-2025-49005 (Vendor Advisory)

Frequently asked questions

What is CVE-2025-49005?: CVE-2025-49005 is a low-severity vulnerability in Vercel Next.js, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 3.7/10. Published 2025-07-03.
How severe is CVE-2025-49005?: Low severity. CVSS v3 base score is 3.7 out of 10.
Is CVE-2025-49005 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.