CVE-2025-30218: Next.js may leak x-middleware-subrequest-id to external hosts
Summary In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.
Learn more here.
Credit
Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
Other sources
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30218?
CVE-2025-30218 is classified as a low severity vulnerability.
How do I fix CVE-2025-30218?
To remediate CVE-2025-30218, upgrade to Next.js version 15.2.4, 14.2.26, 13.5.10, or 12.3.6.
Which versions of Next.js are affected by CVE-2025-30218?
CVE-2025-30218 affects Next.js versions prior to 15.2.4, 14.2.26, 13.5.10, and 12.3.6.
Who reported CVE-2025-30218?
CVE-2025-30218 was independently verified based on reports from multiple independent researchers.
Is CVE-2025-30218 related to another vulnerability?
Yes, CVE-2025-30218 is related to CVE-2025-29927 as part of a broader review of Middleware vulnerabilities.