CVE-2025-57822

MEDIUMNuclei

Next.js Improper Middleware Redirect Handling Leads to SSRF

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-57822 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 2, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

next.js

Browse vercel / next.js
CVE List< 14.2.32affected
< 15.4.7affected

next

Browse npm / next
GitHub Advisory0.9.9 to < 14.2.32 · Fixed in 14.2.32affected
15.0.0-canary.0 to < 15.4.7 · Fixed in 15.4.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMNext.js Middleware - Server-Side Request ForgeryCVSS 6.5

In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.

Impact

Attackers can manipulate request headers to perform SSRF attacks by forcing the server to make requests to arbitrary internal or external URLs when middleware passes headers unsafely.

Remediation

Upgrade Next.js to version 14.2.32, 15.4.7, or later that properly validates and sanitizes request headers in NextResponse.next().

WeaknessesCWE-918
Authorsprdngr, nicolas-latacora
Template tagscvecve2025ssrfnextjsoastoobvuln
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Shodan: cpe:"cpe:2.3:a:zeit:next.js"
Shodan: http.html:"/_next/static"
FOFA: body="/_next/static"
https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f https://vercel.com/changelog/cve-2025-57822 https://nvd.nist.gov/vuln/detail/CVE-2025-57822

Source: ProjectDiscovery

References

5