CVE-2025-57822 json
Next.js Improper Middleware Redirect Handling Leads to SSRF
published 2025-08-29 14 mo ago modified 2026-10-18 21 d ago also EUVD-2025-26245 , GHSA-4342-x723-ch2f
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
2.58% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Next.js Middleware - Server-Side Request Forgery nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | next | >=0.9.9, <14.2.32 >=15.0.0-canary.0, <15.4.7 |
14.2.32 15.4.7 |
Affected products
- vercel next.js
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
- Technology feeds
References
-
github.com
/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
web, patch
-
github.com
/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
web, vendor-advisory, advisory
-
vercel.com
/changelog/cve-2025-57822
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-57822
advisory
-
github.com
/vercel/next.js
package
Sources
- CVE List CVE-2025-57822
- GitHub Advisory GHSA-4342-x723-ch2f
- NVD CVE-2025-57822
- Maintainer advisory GHSA-4342-x723-ch2f
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of vercel/next.js published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.