Description
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vercel | next.js | < 14.2.32, < 15.4.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu +2 | 2.11.0-r1 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Next.js Middleware - Server-Side Request Forgery http/cves/2025/CVE-2025-57822.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | next | >= 0.9.9, < 14.2.32 | 14.2.32 | GHSA-4342-x723-ch2f |
| npm | next | >= 15.0.0-canary.0, < 15.4.7 | 15.4.7 | GHSA-4342-x723-ch2f |
Advisories 1
- WID-SEC-2025-1934 Vercel Next.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 16, 2025