CVE-2025-30218: SSRF in Next.js Middleware

The SSRF vulnerability in Next.js Middleware allows an attacker to craft malicious requests that the server will execute on their behalf. This could lead to unintended access to internal services or resources that are not directly exposed to the internet. While the CVSS score is LOW (2.5), successful exploitation could reveal sensitive information or be a stepping stone for further attacks, especially in environments with complex internal network configurations. The potential impact is amplified if the Middleware is used to proxy requests to internal APIs or databases, as an attacker could potentially bypass access controls and gain unauthorized access.

1. Reserved2025-03-18
2. Published2025-04-02
3. Modified2025-10-13
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-30218 is to upgrade to Next.js version 12.3.6 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on any URLs passed to the Middleware. Additionally, configure your firewall or proxy to restrict outbound connections from the Next.js server to only trusted destinations. Monitor your server logs for unusual outbound requests that might indicate exploitation attempts.

Last updated

16.2.6recently