CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF
Attackers can exploit improper middleware redirect handling in self-hosted Next.js apps to perform Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57822?
CVE-2025-57822 is a medium-severity server-side request forgery vulnerability in Vercel Next.js, published on 29 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Weakness: CWE-918
Which versions are affected by CVE-2025-57822?
4 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 0.9.9 | 14.2.32 |
next npm | From 0.9.9 | 14.2.32 |
next npm | From 15.0.0-canary.0 | 15.4.7 |
next npm | From 15.0.0-canary.0 | 15.4.7 |
Products include Vercel Next.js.
How do I fix CVE-2025-57822?
Upgrade next to a fixed version for your release line: 14.2.32 or 15.4.7.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-57822 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57822 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-4342-x723-ch2f, MINI-2j35-m87x-wrqg, ROOT-APP-NPM-CVE-2025-57822.