Next.js Improper Middleware Redirect Handling Leads to SSRF

The SSRF vulnerability in Next.js Middleware allows an attacker to craft malicious requests that appear to originate from the server itself. This can lead to unauthorized access to internal resources, data exfiltration, and potentially even remote code execution if the server has access to vulnerable internal services. The impact is particularly significant in self-hosted environments where the middleware is used to handle incoming requests and potentially interact with other internal systems. Successful exploitation could allow an attacker to scan internal networks, access sensitive data stored on internal servers, or even manipulate internal services, effectively bypassing security controls.

Organizations deploying self-hosted Next.js applications, particularly those utilizing custom middleware for request handling, are at risk. Environments with less stringent input validation and sanitization practices are especially vulnerable. Developers who are not fully aware of the SSRF implications of passing request headers directly into NextResponse.next() are also at increased risk.

• nodejs: Inspect middleware code for direct usage of NextResponse.next() with request headers. Use grep to search for patterns like nextResponse.next({ headers: req.headers }). • generic web: Monitor access logs for unusual outbound requests originating from the Next.js application server. Look for requests to internal IP addresses or sensitive internal services. • generic web: Examine response headers for unexpected or reflected request headers. Use curl -v <url> to inspect headers.

1. 2025-08-29Disclosure

   disclosure

1. Réservé2025-08-20
2. Publiée2025-08-29
3. Modifiée2026-02-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-57822 is to upgrade to Next.js version 14.2.32 or 15.4.7. If an immediate upgrade is not feasible, carefully review all custom middleware logic to ensure that request headers are not directly passed into NextResponse.next(). Implement strict input validation and sanitization to prevent the reflection of sensitive headers. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests. After upgrading, verify the fix by attempting to craft an SSRF request through the middleware and confirming that it is blocked.

Dernière mise à jour

16.2.6récemment