CVE-2025-30218: Vercel Next.js Information Disclosure Flaw

CVE-2025-30218 Overview

CVE-2025-30218 is an Information Exposure vulnerability in Vercel's Next.js framework that affects the middleware subrequest ID handling mechanism. The vulnerability was introduced as part of a mitigation for CVE-2025-29927, where Next.js implemented validation of the x-middleware-subrequest-id header. However, this subrequest ID persists across multiple incoming requests and is inadvertently sent to all destinations—including third-party hosts—when fetch requests are initiated from within Middleware. This means that sensitive internal request identifiers can leak to external services, potentially enabling tracking or correlation attacks.

Critical Impact

Internal subrequest identifiers are leaked to third-party services through fetch requests initiated in Next.js Middleware, potentially enabling request correlation and information exposure.

Affected Products

• Vercel Next.js versions prior to 12.3.6
• Vercel Next.js versions prior to 13.5.10
• Vercel Next.js versions prior to 14.2.26
• Vercel Next.js versions prior to 15.2.4

Discovery Timeline

• April 2, 2025 - CVE-2025-30218 published to NVD
• September 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30218

Vulnerability Analysis

This vulnerability represents a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) weakness in the Next.js middleware request handling. When Next.js implemented the x-middleware-subrequest-id header validation as a security measure against CVE-2025-29927, it failed to scope the header appropriately. The header was designed to identify and validate subrequests within the Next.js application itself. However, when developers use the fetch() API within Middleware to make requests to external third-party services, the x-middleware-subrequest-id header is included in those outbound requests.

The impact is primarily information disclosure—attackers who control or can monitor third-party endpoints receiving these requests could collect subrequest IDs. While the immediate confidentiality impact is limited, this leakage could be used to correlate requests, fingerprint applications, or potentially aid in more sophisticated attack chains targeting the application's middleware logic.

Root Cause

The root cause lies in the overly broad scope of the x-middleware-subrequest-id header propagation. When the mitigation for CVE-2025-29927 was implemented, the header was added to validate subrequests but was not filtered or stripped from outbound fetch requests to external hosts. The middleware request handling logic did not differentiate between internal subrequests (destined for the Next.js application) and external requests (destined for third-party services), causing the sensitive header to be transmitted beyond the application's trust boundary.

Attack Vector

The vulnerability is exploitable over the network, though exploitation requires specific conditions. An attacker would need to either control a third-party endpoint that the target Next.js application's Middleware fetches data from, or be able to observe network traffic to such endpoints.

The attack scenario involves:

1. A Next.js application uses Middleware that initiates fetch requests to third-party services
2. The x-middleware-subrequest-id header is automatically included in these outbound requests
3. An attacker monitoring or controlling the third-party endpoint captures these headers
4. The captured subrequest IDs could be used to correlate requests, understand application behavior, or potentially assist in other attack vectors

Since no verified code examples are available for this vulnerability, the exploitation mechanism is best understood through the advisory documentation. The vulnerability manifests when Middleware makes external API calls, and the internal subrequest tracking header is not properly scoped. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-30218

Indicators of Compromise

• Presence of x-middleware-subrequest-id headers in outbound requests to third-party services
• Unusual logging patterns in third-party service logs showing Next.js-specific headers
• Network traffic analysis revealing internal middleware headers being transmitted externally

Detection Strategies

• Review Middleware code for any fetch() calls to external third-party endpoints
• Implement network monitoring to detect x-middleware-subrequest-id headers in outbound traffic
• Audit application logs for third-party API calls initiated from Middleware functions
• Use web application firewalls (WAF) to log and alert on sensitive header transmission

Monitoring Recommendations

• Monitor outbound HTTP traffic from Next.js applications for unexpected header leakage
• Implement alerting for requests containing x-middleware-subrequest-id destined for non-application hosts
• Regularly audit Middleware implementations for external service integrations
• Review third-party service logs for any captured Next.js internal headers

How to Mitigate CVE-2025-30218

Immediate Actions Required

• Upgrade Next.js to the patched versions: 12.3.6, 13.5.10, 14.2.26, or 15.2.4 or later
• Review all Middleware code to identify fetch requests to third-party services
• Temporarily disable or refactor Middleware that makes external requests until patching is complete
• Assess whether any sensitive information may have been leaked to third parties

Patch Information

Vercel has released security patches across all affected version branches. The following versions contain the fix for CVE-2025-30218:

• Next.js 12.3.6 and later
• Next.js 13.5.10 and later
• Next.js 14.2.26 and later
• Next.js 15.2.4 and later

For detailed patch information and upgrade guidance, refer to the GitHub Security Advisory and the Vercel Changelog.

Workarounds

• Avoid making fetch requests to third-party services from within Next.js Middleware until patched
• Move external API calls from Middleware to API routes or server-side functions
• Implement a proxy layer that strips sensitive headers before forwarding requests externally
• Review and restrict the scope of Middleware functions to minimize external dependencies

# Upgrade Next.js to the latest patched version
npm update next@latest

# Or upgrade to a specific patched version
npm install [email protected]

# Verify the installed version
npm list next