~ / search / GHSA-223j-4rm8-mrmf

GHSA-223j-4rm8-mrmf

Next.js may leak x-middleware-subrequest-id to external hosts

Source: GitHub Advisory Database (reviewed) Low CVE-2025-30218

Packages

EcosystemPackageAffectedFixed in
npm next >= 12.3.5, < 12.3.6 12.3.6
npm next >= 13.5.9, < 13.5.10 13.5.10
npm next >= 14.2.25, < 14.2.26 14.2.26
npm next >= 15.2.3, < 15.2.4 15.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O). ## Credit Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

References

External links from the advisory. They lead to third-party sites.