CVE-2025-32421 is a race condition vulnerability (CWE-362) affecting the Next.js framework, specifically versions prior to 14.2.24 and between 15.0.0 and 15.1.6. Next.js is a popular React-based framework used for building full-stack web applications. The vulnerability arises in the Pages Router component under certain misconfigurations, where concurrent execution using shared resources is improperly synchronized. This flaw can cause normal HTTP endpoints to serve `pageProps` data—typically intended for internal use in rendering React components—instead of the expected standard HTML content. This behavior can lead to unintended data exposure or application logic errors. The root cause involves the handling of the `x-now-route-matches` HTTP header, which, if not properly stripped from incoming requests, can trigger the race condition. The issue was addressed in versions 14.2.24 and 15.1.6 by removing this header from requests. Notably, applications hosted on Vercel's platform are not vulnerable because their caching mechanism does not rely solely on 200 OK responses without explicit cache-control headers, thereby mitigating the risk. For self-hosted Next.js deployments unable to upgrade immediately, mitigation involves stripping the `x-now-route-matches` header at the content delivery network (CDN) level and enforcing `cache-control: no-store` headers on all at-risk responses to prevent caching of sensitive data. The Next.js maintainers emphasize the importance of caching only responses with explicit cache-control headers to avoid similar issues. The CVSS v3.1 base score is 3.7, indicating a low severity, with the vector showing network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact without integrity or availability effects. No known exploits are reported in the wild as of the publication date.

For European organizations using vulnerable versions of Next.js in self-hosted environments, this vulnerability could lead to inadvertent exposure of internal application data (`pageProps`) through normal endpoints. While the confidentiality impact is limited, such data leakage could reveal sensitive application state or user-related information, potentially aiding attackers in further reconnaissance or targeted attacks. The integrity and availability of applications are not directly affected. Organizations relying on Next.js for customer-facing web applications or internal portals may face reputational risks if sensitive data is exposed. Since Vercel-hosted deployments are not affected, the impact is primarily on enterprises managing their own Next.js infrastructure. Given the low CVSS score and absence of known exploits, the immediate risk is moderate; however, the potential for misconfiguration or caching errors in complex deployment scenarios could elevate exposure. European organizations with strict data protection regulations (e.g., GDPR) must consider the implications of any unintended data disclosure, even if limited, and ensure compliance through prompt patching or mitigation.

1. Upgrade Next.js to versions 14.2.24 or later, or 15.1.6 or later, as these versions contain the official patch removing the vulnerable header handling. 2. For organizations unable to upgrade immediately, implement a CDN or reverse proxy rule to strip the `x-now-route-matches` header from all incoming requests to the Next.js application. 3. Configure HTTP response headers to include `cache-control: no-store` for all endpoints that could be affected, preventing caching of sensitive data by browsers or intermediary caches. 4. Audit existing caching policies and ensure that only responses with explicit cache-control headers are cached, following Next.js maintainers' recommendations. 5. Conduct thorough testing of the Pages Router configuration to verify that no unintended data leakage occurs under concurrent request scenarios. 6. Monitor application logs and traffic for anomalous requests that include the `x-now-route-matches` header or unexpected response payloads. 7. Educate development and operations teams about the risks of improper synchronization and caching in Next.js applications to prevent similar issues in future deployments.