Aller au contenu
Se connecter
1.7 Faible

CVE-2025-30218 Next.js is a React framework for building full-stack web applications

Description

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

Produits et versions touchés

Produit Versions touchées Corrigé en
next.js 15.2.3 Pas de correctif indiqué
next.js 14.2.25 Pas de correctif indiqué
next.js 13.5.9 Pas de correctif indiqué
next.js 12.3.5 Pas de correctif indiqué

Autres CVE de next.js

Les 57 CVE de next.js →
CVE-2026-94482 Next.js is a React framework for building full-stack web applications 8.2 Élevée CVE-2026-94484 Next.js is a React framework for building full-stack web applications 6.3 Moyenne CVE-2026-94485 Next.js is a React framework for building full-stack web applications 6.3 Moyenne CVE-2026-94483 Next.js is a React framework for building full-stack web applications 8.3 Élevée
Suivre cette CVE