Riskcovery

CVE-2025-30218

Next.js may leak x-middleware-subrequest-id to external hosts

State
Published
Severity
1.7 Low
Published
Apr 2, 2025
Updated
Oct 13, 2025
Reserved
Mar 18, 2025

Read the record on cve.org

Description

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

Scores

CVSSScoreVectorSource
4.01.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:UGitHub_M

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
next.jsvercel
  • = 12.3.5Affected
  • = 13.5.9Affected
  • = 14.2.25Affected
  • = 15.2.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.