CVE-2025-30218

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 12.3.6 Next.js versions prior to 13.5.10 Next.js versions prior to 14.2.26 Next.js versions prior to 15.2.4

Description The issue concerns the leakage of the x-middleware-subrequest-id across multiple incoming requests in Next.js, a React framework for building full-stack web applications. This subrequest ID is sent to all requests, including those to third-party destinations, potentially leaking sensitive information.

Recommendations For versions prior to 12.3.6, update to version 12.3.6 or later. For versions prior to 13.5.10, update to version 13.5.10 or later. For versions prior to 14.2.26, update to version 14.2.26 or later. For versions prior to 15.2.4, update to version 15.2.4 or later.