GitHub Advisoryadvisory · npm

GHSA-3h52-269p-cp9r Information exposure in Next.js dev server due to lack of origin verification

LOW Published 2025-05-28 Modified 2025-06-13 Official page ↗
Aliases
CVE-2025-48068
Ecosystem
npm
Packages
next
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-1385
Reviewed
2025-05-28

Affected packages

• npm next: >= 15.0.0, < 15.2.2 → fixed in 15.2.2 • npm next: >= 13.0, < 14.2.30 → fixed in 14.2.30

Description

Summary A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active. Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. Learn more. Learn more: https://vercel.com/changelog/cve-2025-48068 Credit Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.

Related

Alias · CVE (1)

  • CVE-2025-48068 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-1385 Missing Origin Validation in WebSockets weakness

References