PT-2025-14552 · Next.Js · Next.Js

Ry0Tak + 1 · Published 2025-03-25 · Updated 2026-04-01 · CVE-2025-30218

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 12.3.6 Next.js versions prior to 13.5.10 Next.js versions prior to 14.2.26 Next.js versions prior to 15.2.4

Description The issue concerns the leakage of the x-middleware-subrequest-id across multiple incoming requests in Next.js, a React framework for building full-stack web applications. This subrequest ID is sent to all requests, including those to third-party destinations, potentially leaking sensitive information.

Recommendations For versions prior to 12.3.6, update to version 12.3.6 or later. For versions prior to 13.5.10, update to version 13.5.10 or later. For versions prior to 14.2.26, update to version 14.2.26 or later. For versions prior to 15.2.4, update to version 15.2.4 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-03883

CLEANSTART-2026-IL36032

CVE-2025-30218

GHSA-223J-4RM8-MRMF

Affected Products

Next.Js

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30218.json · Exploit
• https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf · Vendor Advisory
• https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03883 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30218 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-IL36032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49005 · Security Note
• https://osv.dev/vulnerability/GHSA-223j-4rm8-mrmf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30218 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65945 · Security Note
• https://github.com/vercel/next.js · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IL36032.json · Note
• https://osv.dev/vulnerability/ghsa-5gfm-wpxj-wjgq · Note
• https://osv.dev/vulnerability/CVE-2025-65945 · Note
• https://osv.dev/vulnerability/ghsa-968p-4wvh-cqc8 · Note