| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| next.js | ≥ 15.0.0, < 15.4.7< 14.2.32 | 15.4.714.2.32 |
| next | ≥ 0.9.9, < 14.2.32≥ 15.0.0-canary.0, < 15.4.7 | 14.2.3215.4.7 |
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン