CVE-2025-32421

CVE-2025-32421 is a race condition vulnerability affecting the Next.js framework, specifically impacting the Pages Router under certain misconfigurations. This vulnerability can cause normal endpoints to serve `pageProps` data instead of standard HTML. The issue affects Next.js versions prior to 14.2.24 and 15.1.6. The vulnerability can be exploited when an attacker leverages a race condition between two requests: one containing the `?__nextDataRequest=1` query parameter and another with the `x-now-route-matches` header. Some CDN providers might cache a 200 OK response even without explicit cache-control headers, which could lead to a poisoned response being served to subsequent users. The vulnerability was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests.