CVE-2025-57822
Next.js Improper Middleware Redirect Handling Leads to SSRF
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js Improper Middleware Redirect Handling Leads to SSRF
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
- Record
CVE-2025-57822- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2025-26245
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
- Record
EUVD-2025-26245- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4342-x723-ch2f
Next.js Improper Middleware Redirect Handling Leads to SSRF
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
- Record
GHSA-4342-x723-ch2f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 13 moreShow less
NVD
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
- Record
CVE-2025-57822- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Next.js Improper Middleware Redirect Handling Leads to SSRF
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
- Record
CVE-2025-57822- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-4342-x723-ch2f
Next.js Improper Middleware Redirect Handling Leads to SSRF
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
- Record
GHSA-4342-x723-ch2f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1791807020 No score
TuxCare security update for 9 packages (28 CVEs)
TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1791807020- Updated
- 2026-11-02
OSVCLSA-2026-1792346490 No score
TuxCare security update for @next/swc-linux-x64-gnu (28 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1792346490- Updated
- 2026-11-02
OSVCLSA-2026-1792367406 No score
TuxCare security update for @next/swc-linux-arm64-gnu (28 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1792367406- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-57822 No score
CVE-2025-57822 in next - Patched by Root
Root has patched CVE-2025-57822 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-57822- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fj No score
GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3 No score
GHSA-q4gf-8mx6-v5v3 in next - Patched by Root
Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.0.0-canary.0 up to 15.4.7 | 15.4.7 |
nextnpm |
0.9.9 up to 14.2.32 | 14.2.32 |
nextnpm |
13.0.0 up to 15.5.16 | 15.5.16 |
nextnpm |
16.0.0 up to 16.2.5 | 16.2.5 |
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
nextnpm |
13.0.0 up to 15.5.15 | 15.5.15 |
nextnpm |
16.0.0-beta.0 up to 16.2.3 | 16.2.3 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 22 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.2, plus listed versions 15.1.215.1.2-tuxcare.1 |
15.1.2-tuxcare.2 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 22 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.2, plus listed versions 15.1.215.1.2-tuxcare.1 |
15.1.2-tuxcare.2 |
nextRoot:npm |
before 13.5.11-aikido.7 | 13.5.11-aikido.713.5.11-aikido.413.5.11-aikido.813.5.11-aikido.513.5.11-aikido.613.5.11-aikido.913.5.11-aikido.314.2.32-aikido.414.2.32-aikido.114.2.32-aikido.514.2.32-aikido.614.2.32-aikido.214.2.32-aikido.714.2.32-aikido.814.2.32-aikido.3 |
@rootio/nextRoot:npm |
before 13.5.11-root.io.7 | 13.5.11-root.io.713.5.11-root.io.413.5.11-root.io.813.5.11-root.io.513.5.11-root.io.613.5.11-root.io.913.5.11-root.io.314.2.32-root.io.414.2.32-root.io.114.2.32-root.io.514.2.32-root.io.614.2.32-root.io.214.2.32-root.io.714.2.32-root.io.814.2.32-root.io.3 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1 |
nextRoot:npm |
before 14.2.5-aikido.8 | 14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.8 | 14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Next.js Middleware - Server-Side Request Forgery |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57822 is a medium vulnerability (CVSS 6.5) in Vercel Next.js, published August 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in next 15.4.7.
References
github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
vercel.com/changelog/cve-2025-57822
nvd.nist.gov/vuln/detail/CVE-2025-57822
Show 14 moreShow less