Next.js Improper Middleware Redirect Handling Leads to SSRF
Affected releases · next
- 15.x15.0.0 – 15.4.6Fixed in 15.4.7
- 14.x14.0.0 – 14.2.31Fixed in 14.2.32
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated
On 15.x, the newest line:
npm install next@15.4.7Not affected
16.0.0 – 16.4.2
45 releases, latest
Affected
15.0.0 – 15.4.6
49 releases
Fixed
15.4.7 – 15.5.28
33 releases
Affected
14.0.0 – 14.2.31
42 releases
Fixed
14.2.32 – 14.2.35
4 releases
Affected
13.0.0 – 13.5.11
56 releases
Affected
12.0.0 – 12.3.7
33 releases
Affected
11.0.0 – 11.1.4
7 releases
Affected
10.0.0 – 10.2.3
18 releases
Affected
9.0.0 – 9.5.5
38 releases
Affected
8.0.0 – 8.1.0
6 releases
Affected
7.0.0 – 7.0.3
4 releases
Affected
6.0.0 – 6.1.2
7 releases
Affected
5.0.0 – 5.1.0
2 releases
Affected
4.0.0 – 4.2.3
15 releases
Affected
3.0.1 – 3.2.3
11 releases
Affected
2.0.0 – 2.4.9
17 releases
Affected
1.0.0 – 1.2.3
10 releases
Not affected
0.1.0 – 0.4.1
23 releases
Affected
0.9.9 – 0.9.11
3 releases
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog