CVE-2025-57822: SSRF in Next.js Middleware

The SSRF vulnerability in Next.js Middleware allows an attacker to craft malicious requests that appear to originate from the server itself. This can lead to unauthorized access to internal resources, data exfiltration, and potentially even remote code execution if the server has access to vulnerable internal services. The impact is particularly significant in self-hosted environments where the middleware is used to handle incoming requests and potentially interact with other internal systems. Successful exploitation could allow an attacker to scan internal networks, access sensitive data stored on internal servers, or even manipulate internal services, effectively bypassing security controls.

1. Reserved2025-08-20
2. Published2025-08-29
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-57822 is to upgrade to Next.js version 14.2.32 or 15.4.7. If an immediate upgrade is not feasible, carefully review all custom middleware logic to ensure that request headers are not directly passed into NextResponse.next(). Implement strict input validation and sanitization to prevent the reflection of sensitive headers. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests. After upgrading, verify the fix by attempting to craft an SSRF request through the middleware and confirming that it is blocked.