CVE-2025-57822
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-57822. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1Attack Vector Metrics
Impact Metrics
Description
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js Middleware versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Available Exploits
Next.js Middleware - Server-Side Request Forgery
In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.
Related News
EU Vulnerability Database
Monitored by ENISA for EU cybersecurity
ENISA Analysis
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js Middleware versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Affected Products (ENISA)
ENISA Scoring
CVSS Score (3.1)
EPSS Score
ENISA References
Data provided by ENISA EU Vulnerability Database. Last updated: August 29, 2025
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Next.js Improper Middleware Redirect Handling Leads to SSRF
GHSA-4342-x723-ch2fAdvisory Details
Affected Packages
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: August 29, 2025, Modified: September 1, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
Vercel Community News Cache (2025-09-01) Highlights from last week in the Vercel community... * Vercel celebrated 10 years of supporting a faster, more personalized web * People shared how they use Vercel to help their communities * An app to support families in the tubie community * A planner for …