CVE-2025-57822

HighCVSS 8.2/10Last modified Oct 18, 2026

Description

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-578232.7A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, CVE-2025-57836.3A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. This affects an unknown pa CVE-2025-578338.1An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection i CVE-2025-578347.5An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380 CVE-2025-578357.5An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 CVE-2025-578367.8An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions d CVE-2025-578372.9Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confident CVE-2025-578384.0Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confide CVE-2025-578394.0Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality CVE-2025-57848.8A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects un CVE-2025-578402.2ADB(Android Debug Bridge) is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availabilit CVE-2025-578468.5Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated att