~ / search / GHSA-3h52-269p-cp9r

GHSA-3h52-269p-cp9r

Information exposure in Next.js dev server due to lack of origin verification

Source: GitHub Advisory Database (reviewed) Low CVE-2025-48068

Packages

EcosystemPackageAffectedFixed in
npm next >= 15.0.0, < 15.2.2 15.2.2
npm next >= 13.0, < 14.2.30 14.2.30

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary A low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active. Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. [Learn more](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins). Learn more: https://vercel.com/changelog/cve-2025-48068 ## Credit Thanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.

References

External links from the advisory. They lead to third-party sites.