Next.js Improper Middleware Redirect Handling Leads to SSRF
Published 29 Aug 2025 · Updated 10 Sept 2026
Affected packages
- Affected
- >=0.9.9 <14.2.32
- Fixed in
- 14.2.32
npm install next@14.2.32- Affected
- >=15.0.0-canary.0 <15.4.7
- Fixed in
- 15.4.7
npm install next@15.4.7Details
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
Is GHSA-4342-x723-ch2f in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.