CVE-2025-49005

T1Covered by 1 source · first reported by Vercel (blog + changelog) at 03 Jul 2025, 13:00 UTC

Summary Impact Resolution Workarounds Credit References Next.js App Router >=15.3.0 < 15.3.3 / Vercel CLI 41.4.1–42.2.0 A cache poisoning vulnerability affectinghas been resolved. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain…