GitHub Advisoryadvisory · npm

GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts

LOW Published 2025-04-02 Modified 2025-10-13 Official page ↗
Aliases
CVE-2025-30218
Ecosystem
npm
Packages
next
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-200
Reviewed
2025-04-02

Affected packages

• npm next: >= 12.3.5, < 12.3.6 → fixed in 12.3.6 • npm next: >= 13.5.9, < 13.5.10 → fixed in 13.5.10 • npm next: >= 14.2.25, < 14.2.26 → fixed in 14.2.26 • npm next: >= 15.2.3, < 15.2.4 → fixed in 15.2.4

Description

Summary In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more here. Credit Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

Related

Alias · CVE (1)

  • CVE-2025-30218 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References