CVE-2025-48068: Next.js Information Disclosure Vulnerability

CVE-2025-48068 Overview

CVE-2025-48068 is a source code disclosure vulnerability affecting Next.js, the popular React framework for building full-stack web applications. This vulnerability allows limited source code exposure when the development server is running with the App Router enabled. The issue is classified as an Information Disclosure vulnerability that specifically impacts local development environments.

Critical Impact

Developers running npm run dev with App Router enabled may inadvertently expose application source code if they visit a malicious webpage during active development sessions.

Affected Products

• Vercel Next.js versions 13.0 to before 14.2.30
• Vercel Next.js versions 15.0.0 to before 15.2.2

Discovery Timeline

• 2025-05-30 - CVE-2025-48068 published to NVD
• 2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-48068

Vulnerability Analysis

This vulnerability represents a source code disclosure weakness (CWE-1385) in the Next.js development server. The issue is particularly noteworthy because it specifically targets the development environment rather than production deployments. When developers are actively running their local development server using npm run dev with the App Router feature enabled, a carefully crafted malicious webpage can exploit the vulnerability to extract portions of the application's source code.

The attack requires user interaction—specifically, the developer must visit a malicious webpage while their development server is actively running. This social engineering requirement, combined with the development-only scope, limits the practical exploitability of this vulnerability. However, source code exposure in development environments can still lead to intellectual property theft or reveal sensitive configuration patterns that could inform attacks against production systems.

Root Cause

The root cause lies in improper handling of requests to the development server when the App Router is enabled. The vulnerability falls under CWE-1385, which addresses the exposure of sensitive information through the improper handling of runtime debugging data in development environments. The Next.js development server failed to adequately restrict access to source code resources, allowing cross-origin requests from malicious webpages to retrieve limited source code content.

Attack Vector

The attack vector requires a network-accessible development server and user interaction. An attacker would need to:

1. Craft a malicious webpage designed to exploit the vulnerability
2. Lure a developer to visit the malicious page while running npm run dev
3. The malicious page makes requests to the local development server
4. The development server improperly responds with source code fragments

The exploitation mechanism involves cross-origin requests that the development server fails to properly validate or restrict. Since no proof-of-concept code has been publicly disclosed, specific technical details about the exact request patterns are not available. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-48068

Indicators of Compromise

• Unusual network requests to local development server ports (typically 3000) from external domains
• Browser console logs showing cross-origin requests to localhost during development sessions
• Network traffic analysis revealing source code content in HTTP responses to external origins

Detection Strategies

• Monitor development workstations for unexpected outbound connections while the Next.js dev server is running
• Implement browser extensions or security policies that alert on cross-origin requests to localhost
• Review web browser history for suspicious URLs visited during development sessions

Monitoring Recommendations

• Enable network monitoring on development machines to detect anomalous localhost traffic patterns
• Configure Content Security Policy headers in development environments where feasible
• Maintain awareness of phishing attempts targeting development teams with links to potentially malicious sites

How to Mitigate CVE-2025-48068

Immediate Actions Required

• Upgrade Next.js to version 14.2.30 or later for the 14.x branch
• Upgrade Next.js to version 15.2.2 or later for the 15.x branch
• Avoid visiting untrusted websites while the development server is actively running
• Consider stopping the development server when browsing external sites

Patch Information

Vercel has released patched versions that address this vulnerability:

• Version 14.2.30 - Fixes the vulnerability for the 14.x release line
• Version 15.2.2 - Fixes the vulnerability for the 15.x release line

For detailed patch information and upgrade instructions, refer to the Vercel Changelog and the GitHub Security Advisory.

Workarounds

• Stop the development server when not actively developing
• Use browser profiles or containers to isolate development browsing from general web browsing
• Bind the development server to 127.0.0.1 only rather than 0.0.0.0
• Consider using browser extensions that block cross-origin requests to localhost

# Update Next.js to patched version
npm install [email protected]
# or for Next.js 15.x users
npm install [email protected]

# Verify installed version
npm list next