vercel/next.js · Security
Next.js may leak x-middleware-subrequest-id to external hosts
- GHSA ID
- GHSA-223j-4rm8-mrmf
- CVE ID
- CVE-2025-30218
- Severity
- low
- Published
- Updated
- CVSS v4
- 1.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Description
Summary
In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.
Learn more here.
Credit
Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor