TI-2025-35705 Aliases CVE-2025-57822 GHSA-4342-x723-ch2f

Next.js Improper Middleware Redirect Handling Leads to SSRF

MEDIUM 41CWE-918Published 2025-08-29 · Updated 2025-09-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02584 85th percentileScored 2026-11-07

Fix Fixed next.js (vercel): 14.2.32, 15.4.7next (npm): 14.2.32, 15.4.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vercel	next.js	before 14.2.32; before 15.4.7	14.2.32, 15.4.7	Patch available	CNA
—	next (npm)	0.9.9 to before 14.2.32	14.2.32	Patch available	GHSA-4342-x723-ch2f
—	next (npm)	15.0.0-canary.0 to before 15.4.7	15.4.7	Patch available	GHSA-4342-x723-ch2f

next.js Vendorvercel Affected before 14.2.32; before 15.4.7 Fixed in 14.2.32, 15.4.7 Patch available CNA
next (npm) Vendor— Affected 0.9.9 to before 14.2.32 Fixed in 14.2.32 Patch available GHSA-4342-x723-ch2f
next (npm) Vendor— Affected 15.0.0-canary.0 to before 15.4.7 Fixed in 15.4.7 Patch available GHSA-4342-x723-ch2f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vercel:next.js::::::node.js::*	before 14.2.32; 15.0.0 to before 15.4.7	Vulnerable	vercel

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions before 14.2.32; 15.0.0 to before 15.4.7 Vulnerable ·vercel

Remediation

Fix · CNA next.js (vercel) Fixed in 14.2.32, 15.4.7
Fix · GHSA-4342-x723-ch2f next (npm) Fixed in 14.2.32 Advisory →
Fix · GHSA-4342-x723-ch2f next (npm) Fixed in 15.4.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-57822
2026-10-03 Alias added: GHSA-4342-x723-ch2f

References

Patch 1

https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8

Advisory 3

Other 1

https://github.com/vercel/next.js

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences