GHSA-4342-x723-ch2fMediumCVSS 6.5
Next.js Improper Middleware Redirect Handling Leads to SSRF
🔗 CVE IDs covered (1)
📋 Description
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
🎯 Affected products2
- npm/next:>= 15.0.0-canary.0, < 15.4.7
- npm/next:>= 0.9.9, < 14.2.32