PT-2025-14552 · Next.Js · Next.Js
Ry0Tak
+1
·
Publicado
2025-03-25
·
Atualizado
2026-04-01
·
CVE-2025-30218
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Next.js versions prior to 12.3.6
Next.js versions prior to 13.5.10
Next.js versions prior to 14.2.26
Next.js versions prior to 15.2.4
Description
The issue concerns the leakage of the
x-middleware-subrequest-id across multiple incoming requests in Next.js, a React framework for building full-stack web applications. This subrequest ID is sent to all requests, including those to third-party destinations, potentially leaking sensitive information.Recommendations
For versions prior to 12.3.6, update to version 12.3.6 or later.
For versions prior to 13.5.10, update to version 13.5.10 or later.
For versions prior to 14.2.26, update to version 14.2.26 or later.
For versions prior to 15.2.4, update to version 15.2.4 or later.
Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Next.Js