{"id":"CVE-2025-57822","published":"2025-08-29T21:33:15Z","modified":"2025-09-02T17:26:25Z","title":"Next.js Improper Middleware Redirect Handling Leads to SSRF","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02584,"percentile":0.85221,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8","tags":["x_refsource_MISC"]},{"url":"https://vercel.com/changelog/cve-2025-57822","tags":["x_refsource_MISC"]}],"priority":{"score":26.6,"factors":[{"name":"EPSS percentile","points":17.04},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.55}]},"exploitSources":{"nuclei":[{"id":"CVE-2025-57822","name":"Next.js Middleware - Server-Side Request Forgery","severity":"medium","path":"http/cves/2025/CVE-2025-57822.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57822.yaml"}],"provenance":"source"},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":["< 14.2.32","< 15.4.7"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=0.9.9, <14.2.32",">=15.0.0-canary.0, <15.4.7"],"patched":["14.2.32","15.4.7"],"from":["GHSA-4342-x723-ch2f"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-26245","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vercel-next-js-cve-2023-46298","parents":[{"from":"CVE-2024-51479","to":"CVE-2025-57822","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/next/src/server/lib/router-utils/resolve-routes.ts"],"commits":["https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b","https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8"],"basis":"shared function","functions":["getResolveRoutes"]}]}],"packageHistory":[{"cve":"CVE-2025-49005","published":"2025-07-03","fixed":"15.3.3","kev":false},{"cve":"CVE-2025-55173","published":"2025-08-29","fixed":"15.4.5","kev":false},{"cve":"CVE-2025-57752","published":"2025-08-29","fixed":"15.4.5","kev":false,"link":{"from":"CVE-2025-57752","to":"CVE-2025-57822","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"15.4.5","toFixed":"15.4.7","daysApart":0},{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.2.31","toFixed":"14.2.32","daysApart":0}]}},{"cve":"CVE-2025-57822","published":"2025-08-29","fixed":"15.4.7","kev":false},{"cve":"CVE-2025-59471","published":"2026-01-26","fixed":"16.1.5","kev":false,"link":{"from":"CVE-2025-57822","to":"CVE-2025-59471","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"15.4.7","toFixed":"15.5.10","daysApart":150}]}},{"cve":"CVE-2025-59472","published":"2026-01-26","fixed":"16.1.5","kev":false},{"cve":"CVE-2026-27977","published":"2026-03-17","fixed":"16.1.7","kev":false}],"package":"npm:next"}}