CVE-2025-30218: Next.js may leak x-middleware-subrequest-id to external hosts
First published: Wed Apr 02 2025(Updated: )
## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O). ## Credit Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vercel | <12.3.6<13.5.10<14.2.26<15.2.4 | |
| npm/next | =15.2.3 | 15.2.4 |
| npm/next | =14.2.25 | 14.2.26 |
| npm/next | =13.5.9 | 13.5.10 |
| npm/next | =12.3.5 | 12.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-30218?
CVE-2025-30218 is classified as a low severity vulnerability.
How do I fix CVE-2025-30218?
To remediate CVE-2025-30218, upgrade to Next.js version 15.2.4, 14.2.26, 13.5.10, or 12.3.6.
Which versions of Next.js are affected by CVE-2025-30218?
CVE-2025-30218 affects Next.js versions prior to 15.2.4, 14.2.26, 13.5.10, and 12.3.6.
Who reported CVE-2025-30218?
CVE-2025-30218 was independently verified based on reports from multiple independent researchers.
Is CVE-2025-30218 related to another vulnerability?
Yes, CVE-2025-30218 is related to CVE-2025-29927 as part of a broader review of Middleware vulnerabilities.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/softwarecombine
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-223j-4rm8-mrmf
- alias/CVE-2025-30218
- agent/references
- agent/description
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- collector/github-advisory
- vendor/vercel
- canonical/vercel
- package-manager/npm