| Package | Affected versions | Patched versions |
|---|---|---|
| next.js | ≥ 15.0.0, < 15.4.7< 14.2.32 | 15.4.714.2.32 |
| next | ≥ 0.9.9, < 14.2.32≥ 15.0.0-canary.0, < 15.4.7 | 14.2.3215.4.7 |
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free