Skip to content
Sign in
1.7 Low

CVE-2025-30218 Next.js is a React framework for building full-stack web applications

Description

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

Affected products and versions

Product Affected versions Fixed in
next.js 15.2.3 No fix stated
next.js 14.2.25 No fix stated
next.js 13.5.9 No fix stated
next.js 12.3.5 No fix stated

Other CVEs of next.js

The 57 CVEs of next.js →
CVE-2026-94482 Next.js is a React framework for building full-stack web applications 8.2 High CVE-2026-94484 Next.js is a React framework for building full-stack web applications 6.3 Medium CVE-2026-94485 Next.js is a React framework for building full-stack web applications 6.3 Medium CVE-2026-94483 Next.js is a React framework for building full-stack web applications 8.3 High
Track this CVE