CVE-2025-49005
- CVSS
- —
- EPSS
- 0.005 (36.9th percentile)
- CISA KEV
- Not listed
- Exploitation
- No report
- Public exploits
- None seen
- State
- Unknown
Coverage
Vercel (blog + changelog)
CVE-2025-49005
Summary Impact Resolution Workarounds Credit References Next.js App Router >=15.3.0 < 15.3.3 / Vercel CLI 41.4.1–42.2.0 A cache poisoning vulnerability affectinghas been resolved. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain…
What we observed
No signals recorded