{"id":"EUVD-2025-26245","enisaUuid":"8e76b81b-9976-3559-bf1e-1e95cb3f370f","description":"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.","datePublished":"Aug 29, 2025, 9:33:15 PM","dateUpdated":"Sep 2, 2025, 5:26:25 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f\nhttps://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8\nhttps://vercel.com/changelog/cve-2025-57822\n","aliases":"CVE-2025-57822\nGHSA-4342-x723-ch2f\n","assigner":"GitHub_M","epss":2.58,"enisaIdProduct":[{"id":"618c3c1f-3f19-3f5c-885f-63abe1e08cf9","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 14.2.32"},{"id":"8d12ab88-ba95-3a5a-a0d2-790f48137f98","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 15.4.7"}],"enisaIdVendor":[{"id":"db4066a1-7b90-3a80-9087-b36a45931d37","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"48bb13df-f653-34ce-b7b6-f936f277a2b2","vulnerability":{"id":"CVE-2025-57822","description":"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.","datePublished":"Aug 29, 2025, 9:33:15 PM","dateUpdated":"Sep 2, 2025, 5:26:25 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f\nhttps://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8\nhttps://vercel.com/changelog/cve-2025-57822\n","enisa_id":"EUVD-2025-26245\n","assigner":"GitHub_M","epss":2.58,"dataProcessed":"Oct 27, 2026, 7:13:59 AM","vulnerabilityProduct":[{"id":"131124c4-3709-4a4c-8f9c-32ae9a25dff3","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 15.4.7"},{"id":"3cd55b85-335e-38a6-9973-02f78fc714ad","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 15.4.7"},{"id":"d1edb87d-f5ca-4b55-a0e0-3664f5bea520","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 14.2.32"},{"id":"e94c0947-a591-3e67-8ba4-365433431e82","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"\u003c 14.2.32"}],"vulnerabilityVendor":[{"id":"4c182c33-7d99-30e0-8500-cf0d50296b79","vendor":{"name":"vercel"}}]}},{"id":"6511acfc-e79b-3149-92dc-9d368a261928","vulnerability":{"id":"GHSA-4342-x723-ch2f","description":"Next.js Improper Middleware Redirect Handling Leads to SSRF","datePublished":"Aug 29, 2025, 9:33:09 PM","dateUpdated":"Sep 11, 2025, 3:41:02 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-57822\nhttps://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8\nhttps://github.com/vercel/next.js\nhttps://vercel.com/changelog/cve-2025-57822\n","enisa_id":"EUVD-2025-26245\n","aliases":"CVE-2025-57822\nGHSA-4342-x723-ch2f\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}