{"id":"EUVD-2025-26245","revision":"5c4b55b5eabe46ad9a159783f45b4d10","records":[{"revision":"5c4b55b5eabe46ad9a159783f45b4d10","observedAt":"2026-11-09T03:12:52.508+00:00","statement":{"source":"euvd","id":"EUVD-2025-26245","aliases":["CVE-2025-57822","GHSA-4342-x723-ch2f"],"title":"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrec…","description":"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":6.5,"severity":null}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f","https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8","https://vercel.com/changelog/cve-2025-57822"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26245","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 29, 2025, 9:33:15 PM","dateUpdated":"Sep 2, 2025, 5:26:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-26245","identifiers":["EUVD-2025-26245","CVE-2025-57822","GHSA-4342-x723-ch2f"]},"retained":false,"historicalAffected":[]}],"coverage":[]}