En bref
- CVE-2025-30218 est une vulnérabilité MOYENNE (CVSS 5.9) touchant next.js (vercel), next.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.43%, plus élevée que 37.4% des vulnérabilités.
- Correctif : mettre à jour vers 12.3.6, 13.5.10, 14.2.26, 15.2.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| next.js | = 12.3.5= 13.5.9= 14.2.25= 15.2.3
| No fix yet |
| next npm | ≥ 12.3.5, < 12.3.6≥ 13.5.9, < 13.5.10≥ 14.2.25, < 14.2.26≥ 15.2.3, < 15.2.4
| 12.3.613.5.1014.2.2615.2.4
|
Description
Summary
In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.
Learn more here.
Credit
Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
NVD description
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free