CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts
Next.js leaks internal middleware subrequest IDs to external hosts during fetch requests, potentially exposing sensitive internal state information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30218?
CVE-2025-30218 is a low-severity vulnerability in Vercel Next.js, published on 2 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
Weakness: CWE-200
Which versions are affected by CVE-2025-30218?
8 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 12.3.5 | 12.3.6 |
next npm | From 12.3.5 | 12.3.6 |
next npm | From 13.5.9 | 13.5.10 |
next npm | From 13.5.9 | 13.5.10 |
next npm | From 14.2.25 | 14.2.26 |
next npm | From 14.2.25 | 14.2.26 |
2 more packages
next npm | From 15.2.3 | 15.2.4 |
next npm | From 15.2.3 | 15.2.4 |
Products include Vercel Next.js.
How do I fix CVE-2025-30218?
Upgrade next to a fixed version for your release line: 12.3.6, 13.5.10, 14.2.26 or 15.2.4.
Is CVE-2025-30218 being exploited?
There is no known exploitation of CVE-2025-30218 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as CLEANSTART-2026-HK16178, GHSA-223j-4rm8-mrmf.