CVE-2025-30218

unknown

Published 2025-04-02 · Modified 2025-10-13

CVSS v3

—

CVSS v2

—

VIR risk

—

Description

Next.js may leak x-middleware-subrequest-id to external hosts

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact

Ecosystem	Package	Vulnerable	Fixed
npm	next	`>=12.3.5,<12.3.6`	`12.3.6`
npm	next	`>=13.5.9,<13.5.10`	`13.5.10`
npm	next	`>=14.2.25,<14.2.26`	`14.2.26`
npm	next	`>=15.2.3,<15.2.4`	`15.2.4`

References

Verify integrity in audit chain (admin only). AS-IS.