CVE-2025-30218
By Steven Van ·
A low-severity Next.js Middleware flaw leaked an internal subrequest ID to third parties, with patches for 15.x and backports for 12.x to 14.x.
Next.js has a second Middleware vulnerability, CVE-2025-30218, rated low severity. Vercel found it while remediating CVE-2025-29927 and verified it alongside two reports from independent researchers.
The fix for the earlier CVE made Next.js validate an x-middleware-subrequest-id header. That ID is sent on every fetch made from Middleware, including requests to third-party hosts, so a third party receiving one would get the ID. Vercel says exploitation is unlikely, since an attacker would need to control that third party.
Vercel customers are protected by mitigations in the platform environment, and other hosts of Next.js applications are not affected, because the issue is specific to Vercel's recursion protection. Vercel still encourages teams to update to the latest Next.js patch version or a backport. It patched 15.x and offered backports for 12.x through 14.x, an exception to its new LTS policy. Vercel says it had already planned to remove this recursion prevention logic, which newer Middleware updates for the Node.js runtime do not support.
Infrastructure providers that want early disclosure of Next.js issues can email partners@nextjs.org.