CVE-2025-57822
By Steven Van ·
The Next.js Middleware SSRF flaw hit self-hosted apps below v14.2.32 and v15.4.7 that misused NextResponse.next(); Vercel's own infrastructure wasn't exploitable.
A server-side request forgery vulnerability in Next.js Middleware, tracked as CVE-2025-57822, has been fixed. It affected versions before v14.2.32 and v15.4.7, and arose when middleware reflected a user's request headers into NextResponse.next() instead of passing them through the request object, which could let an attacker influence the destination of internal requests triggered by middleware routing, or perform SSRF against internal infrastructure.
Vercel patched the issue for its own customers on 25 August 2025; its platform isolates internal request behaviour, so it was not exploitable there. Self-hosted deployments with custom middleware that don't follow the documented NextResponse.next({ request }) pattern, or that forward user-controlled headers like Location without validation, remain at risk until upgraded. The fix ships in Next.js v14.2.32 and v15.4.7.