Next.js may leak x-middleware-subrequest-id to external hosts

The SSRF vulnerability in Next.js Middleware allows an attacker to craft malicious requests that the server will execute on their behalf. This could lead to unintended access to internal services or resources that are not directly exposed to the internet. While the CVSS score is LOW (2.5), successful exploitation could reveal sensitive information or be a stepping stone for further attacks, especially in environments with complex internal network configurations. The potential impact is amplified if the Middleware is used to proxy requests to internal APIs or databases, as an attacker could potentially bypass access controls and gain unauthorized access.

Organizations using Next.js Middleware in production environments, particularly those with complex internal network configurations or that rely on the Middleware to proxy requests to internal APIs or databases, are at risk. Applications using older versions of Next.js (<= 12.3.5) are directly affected.

• nodejs / server:

  npm audit next

• nodejs / server:

  npx next telemetry --log-level debug | grep -i "middleware"

• generic web: Check Next.js version exposed in headers or JavaScript files. Look for version numbers <= 12.3.5.

1. 2025-04-02Disclosure

   disclosure

1. 已保留2025-03-18
2. 发布日期2025-04-02
3. 修改日期2025-10-13
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-30218 is to upgrade to Next.js version 12.3.6 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on any URLs passed to the Middleware. Additionally, configure your firewall or proxy to restrict outbound connections from the Next.js server to only trusted destinations. Monitor your server logs for unusual outbound requests that might indicate exploitation attempts.

最后更新

16.2.6最近