# CVE-2025-57822

By Steven Van · 2025-08-29

The Next.js Middleware SSRF flaw hit self-hosted apps below v14.2.32 and v15.4.7 that misused NextResponse.next(); Vercel's own infrastructure wasn't exploitable.

A server-side request forgery vulnerability in Next.js Middleware, tracked as **CVE-2025-57822**, has been fixed. It affected versions before **v14.2.32** and **v15.4.7**, and arose when middleware reflected a user's request headers into [NextResponse.next()](<https://nextjs.org/docs/app/api-reference/functions/next-response#next>) instead of passing them through the request object, which could let an attacker influence the destination of internal requests triggered by middleware routing, or perform SSRF against internal infrastructure.

[Vercel](<https://creatorstoolbox.com/tools/vercel>) patched the issue for its own customers on 25 August 2025; its platform isolates internal request behaviour, so it was not exploitable there. Self-hosted deployments with custom middleware that don't follow the documented NextResponse.next({ request }) pattern, or that forward user-controlled headers like Location without validation, remain at risk until upgraded. The fix ships in Next.js v14.2.32 and v15.4.7.

[![](<https://nextjs.org/api/docs-og?title=Functions:%20NextResponse&sig=48159b96c5305ea7>)](<https://nextjs.org/docs/app/api-reference/functions/next-response#next>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://nextjs.org/docs/app/api-reference/functions/next-response#next>)

[Read CVE-2025-57822 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-cve-2025-57822>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-57822