GHSA-223j-4rm8-mrmfLow

Next.js may leak x-middleware-subrequest-id to external hosts

Published
April 2, 2025
Last Modified
October 13, 2025

🔗 CVE IDs covered (1)

CVE-2025-30218 →

📋 Description

Summary

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.

Learn more here.

Credit

Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

🎯 Affected products4

  • npm/next:= 12.3.5
  • npm/next:= 13.5.9
  • npm/next:= 14.2.25
  • npm/next:= 15.2.3

🔗 References (4)