CVE-2025-30218

score

<0.1

cvss

5.9

epss

0.4%

published

2025-04-02

kev added

—

first seen

2026-10-21

Next.js versions before 12.3.6, 13.5.10, 14.2.26, and 15.2.4 contain a security issue caused by insufficient validation of the x-middleware-subrequest-id, which is sent to all requests including third-party hosts, potentially leading to information disclosure, exploit requires initiating fetch requests to third-party hosts within Middleware.