CVE-2025-57822 PoC — Next.js Improper Middleware Redirect Handling Leads to SSRF

Title:Next.js Improper Middleware Redirect Handling Leads to SSRF (CVE-2025-57822)
Description:Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.

 id: CVE-2025-57822

info:
  name: Next.js Middleware - Server-Side Request Forgery
  author: prdngr,

...