CVE-2025-30218

mediumpriority · track · 24EPSS 0.004 · 37 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.43% (37th) EPSS

CVSS 5.9 · medium

Is it mine?

16 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–5.9

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 3.6

v3.13.7lowAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v4.01.7lowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:Usecondary · ENISA EU

v4.01.7lowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200USCWE-200US

affected products (16)

Products and version ranges known to be affected.

vercel next.js≤ = 14.2.25enisa_euvdEU
vercel next.js≤ = 12.3.5enisa_euvdEU
vercel next.js≤ = 15.2.3enisa_euvdEU
vercel next.js≤ = 13.5.9enisa_euvdEU
vercel next.js≤ 12.3.5fstec_bduRU
vercel next.js≤ 13.5.9fstec_bduRU
vercel next.js≤ 14.2.25fstec_bduRU
vercel next.js≤ 15.2.3fstec_bduRU
vercel next.js= 12.3.5nvdUScpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*
vercel next.js= 13.5.9nvdUScpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*
vercel next.js= 14.2.25nvdUScpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*
vercel next.js= 15.2.3nvdUScpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*
npm next12.3.5 → 12.3.6osvUSpkg:npm/next
npm next13.5.9 → 13.5.10osvUSpkg:npm/next
npm next14.2.25 → 14.2.26osvUSpkg:npm/next
npm next15.2.3 → 15.2.4osvUSpkg:npm/next

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-223j-4rm8-mrmfNext.js may leak x-middleware-subrequest-id to external hosts2025-04-02ghsa · osvUS
## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O). ## Credit Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2025-04-02modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan