Packages / next / Security

LowVulnerabilityGHSA-223j-4rm8-mrmfCVE-2025-30218Published 2 Apr 2025

Next.js may leak x-middleware-subrequest-id to external hosts

Affected releases · next

  • 15.x15.2.3Fixed in 15.2.4
  • 14.x14.2.25Fixed in 14.2.26
  • 13.x13.5.9Fixed in 13.5.10
  • 12.x12.3.5Fixed in 12.3.6

On 15.x, the newest line:

npm install next@15.2.4
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Not affected

    15.0.0 – 15.2.2

    25 releases

  2. Affected

    15.2.3

    1 release

  3. Fixed

    15.2.4 – 15.5.28

    56 releases

14.x

  1. Not affected

    14.0.0 – 14.2.24

    35 releases

  2. Affected

    14.2.25

    1 release

  3. Fixed

    14.2.26 – 14.2.35

    10 releases

13.x

  1. Not affected

    13.0.0 – 13.5.8

    53 releases

  2. Affected

    13.5.9

    1 release

  3. Fixed

    13.5.10 – 13.5.11

    2 releases

12.x

  1. Not affected

    12.0.0 – 12.3.4

    30 releases

  2. Affected

    12.3.5

    1 release

  3. Fixed

    12.3.6 – 12.3.7

    2 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Summary

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.

Learn more here.

Credit

Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.