CVE-2025-57822 in next.js
Summary
by MITRE • 08/30/2025
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js Middleware versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2025
This vulnerability in Next.js represents a critical server-side request forgery issue that specifically affects self-hosted applications utilizing custom middleware. The flaw occurs when developers use the next() function without explicitly passing the request object, creating a pathway for malicious actors to manipulate internal network requests. The vulnerability is particularly dangerous in environments where user-supplied headers are incorrectly forwarded to internal services, as it allows attackers to potentially access internal resources that should remain protected. This issue impacts applications built with Next.js versions prior to 14.2.32 and 15.4.7, making it a widespread concern for organizations maintaining custom middleware implementations.
The technical implementation of this vulnerability stems from how Next.js middleware handles request object propagation when next() is called without explicit parameter passing. When the request object is not explicitly provided to next(), the framework may inadvertently forward user-controllable headers to internal services, enabling attackers to craft malicious requests that bypass normal access controls. This behavior aligns with CWE-918, which describes server-side request forgery vulnerabilities where applications fail to properly validate or sanitize user input before using it in outbound requests. The vulnerability specifically exploits the trust relationship between the application server and internal services, allowing attackers to potentially probe internal networks, access sensitive data, or perform unauthorized operations on backend systems.
The operational impact of CVE-2025-57822 extends beyond simple data leakage, as it can enable attackers to conduct reconnaissance of internal network infrastructure and potentially escalate privileges within the application environment. Self-hosted applications are particularly vulnerable because they often lack the robust network segmentation and access controls present in cloud-hosted environments. Organizations implementing custom middleware in Next.js applications face significant risk, as the vulnerability can be exploited to access internal services that may contain sensitive information or critical business functions. The attack surface is particularly large in applications that forward headers from user requests to internal services without proper validation, creating a direct pathway for malicious actors to leverage this flaw.
Mitigation strategies for this vulnerability require immediate upgrading of Next.js applications to versions 14.2.32 or 15.4.7, which contain the necessary patches to address the SSRF vulnerability. Security teams should conduct thorough code reviews to identify all instances where next() is used without explicit request object parameters, particularly in custom middleware implementations. The recommended approach involves explicitly passing the request object to next() calls to ensure proper handling of user input and prevent unintended header forwarding. Additionally, organizations should implement network segmentation and access controls to limit internal service exposure, as outlined in the ATT&CK framework's methodology for defending against server-side request forgery attacks. Regular security assessments and penetration testing should be conducted to verify that middleware implementations properly handle request objects and do not inadvertently expose internal systems to external threats.