GHSA-223j-4rm8-mrmf
Next.js may leak x-middleware-subrequest-id to external hosts
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-30218
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Description
## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O). ## Credit Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · next | introduced 12.3.5, fixed 12.3.6 |
| npm · next | introduced 13.5.9, fixed 13.5.10 |
| npm · next | introduced 14.2.25, fixed 14.2.26 |
| npm · next | introduced 15.2.3, fixed 15.2.4 |
Références
- https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-30218 ADVISORY
- https://github.com/vercel/next.js PACKAGE
- https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |