Next.js may leak x-middleware-subrequest-id to external hosts

中 5.9CVE-2025-30218 · GHSA-223j-4rm8-mrmf · 02/04/2025 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
next.js vercel	`= 12.3.5= 13.5.9= 14.2.25= 15.2.3`	修正版なし
next npm	`≥ 12.3.5, < 12.3.6≥ 13.5.9, < 13.5.10≥ 14.2.25, < 14.2.26≥ 15.2.3, < 15.2.4`	`12.3.613.5.1014.2.2615.2.4`

概要

Summary

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.

Learn more here.

Credit

Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

NVD の説明

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

参考情報

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-30218 · ADVISORY
vercel/next.js · PACKAGE
vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

next.js

vercel

= 12.3.5= 13.5.9= 14.2.25= 15.2.3

修正版なし

npm

≥ 12.3.5, < 12.3.6≥ 13.5.9, < 13.5.10≥ 14.2.25, < 14.2.26≥ 15.2.3, < 15.2.4

12.3.613.5.1014.2.2615.2.4

概要

Summary

Learn more here.

Credit

Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

NVD の説明