CVE-2025-32421

What it actually does

Race condition in the Pages Router allows misconfigured endpoints to return serialized pageProps data instead of rendered HTML responses.

Why it matters to the business

Under specific misconfigurations, applications may inadvertently expose internal page data to clients, potentially affecting response correctness and increasing support burden until patched.

How an attack unfolds

An attacker sends concurrent requests to a misconfigured Pages Router endpoint while the application is under load, triggering the race condition that causes pageProps to be served instead of HTML.

How to fix it

Upgrade vercel/next.js to commit 756be15c4cfecb6fae1c69cae7cfaf336423b6cf or later; review and correct any Pages Router misconfigurations that expose props data.

How to confirm the fix worked

Confirm the installed Next.js version includes commit 756be15c4cfecb6fae1c69cae7cfaf336423b6cf; test affected endpoints under concurrent load to verify HTML responses are consistently returned.

Typical attack path

1. Identify endpoints using the Pages Router in a misconfigured Next.js deployment
2. Issue multiple simultaneous requests to the target endpoint
3. Observe responses containing raw pageProps data instead of HTML
4. Inspect returned data for any sensitive values present in props

How to detect it

Review application logs for concurrent requests to Pages Router endpoints that result in non-HTML responses; inspect response bodies for JSON-like structures containing pageProps keys.

What your security team should do

• Immediately upgrade all Next.js deployments to the fixed commit
• Audit Pages Router usage for misconfigurations that could trigger the issue
• Monitor for any unusual response content types or sizes on affected routes