CVE-2025-57822: SSRF vulnerability in Next.js middleware patched

Summary

Impact

Resolution

Workarounds

Credit

References

A vulnerability affecting has been addressed. It impacted versions prior to and , and involved a risk introduced by misconfigured usage of the function within middleware. Applications that reflected a user's request headers in this function, rather than passing them through the object, could unintentionally allow the server to issue requests to attacker-controlled destinations. Next.js Middlewarev14.2.32v15.4.7Server-Side Request Forgery (SSRF)NextResponse.next()request

A patch applied on August 25th, 2025 eliminated exposure for Vercel customers running the affected versions.

In affected configurations, an attacker could:

This issue is exploitable in self-hosted deployments where developers use custom middleware logic and do not adhere to documented usage of . It is on Vercel infrastructure, which isolates and protects internal request behavior.NextResponse.next({ request })not exploitable

The issue was resolved by updating the internal middleware logic to prevent unsafe fallback behavior when is omitted from the call. This ensures the origin server behavior cannot be unintentionally altered by user-supplied headers or misrouted requests.requestnext()

Fix available in:

For users who cannot upgrade immediately:

Thanks to at RootSys, and and the for their responsible disclosure.Dominik ProdingerNicolas Lamoureux Latacora team

Read more

• Influence the destination of internal requests triggered by middleware routing logic

• Perform SSRF against internal infrastructure if user-controlled headers (e.g.,

  ) were forwarded or interpreted without validationLocation

• Potentially access sensitive internal resources or services unintentionally exposed via internal redirect behavior

• Next.js v14.2.32

• Next.js v15.4.7

• Ensure middleware follows official guidance: Use to explicitly pass the request objectNextResponse.next({ request })

• Avoid forwarding user-controlled headers to downstream systems without validation

• Ensure headers that should never be sent from client to server are not reflected back to the client via , such as .NextResponse.nextLocation

• Next.js Release v14.2.32

• Next.js Release v15.4.7

• Next.js Middleware Documentation