CVE-2025-57822: Next.js Improper Middleware Redirect Handling Leads to SSRF
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
Other sources
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57822?
CVE-2025-57822 has been classified as a critical vulnerability due to potential SSRF risks in self-hosted environments.
How do I fix CVE-2025-57822?
To mitigate CVE-2025-57822, upgrade to Next.js versions 14.2.32 or 15.4.7 as recommended.
What applications are affected by CVE-2025-57822?
CVE-2025-57822 affects self-hosted Next.js applications that improperly handle user-supplied headers.
What is the nature of the vulnerability in CVE-2025-57822?
CVE-2025-57822 involves Server-Side Request Forgery (SSRF) due to incorrect usage of the `next()` function.
Who is the vendor for CVE-2025-57822?
The vendor for CVE-2025-57822 is Vercel, the creator of Next.js.