CVE-2025-30218

🗓️ 02 Apr 2025 22:15:19Reported by [email protected]Type

Next.js fixed CVE-2025-30218 which exposed subrequest ID to third parties in multiple requests.

Reporter	Title	Published	Views	Family All 14
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Processing	30 Dec 202512:59	–	ibm
BDU FSTEC	The vulnerability of the Next.js software platform for creating web applications lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.	3 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-30218	2 Apr 202518:14	–	circl
CNNVD	Next.js 信息泄露漏洞	2 Apr 202500:00	–	cnnvd
CVE	CVE-2025-30218	2 Apr 202521:23	–	cve
Cvelist	CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts	2 Apr 202521:23	–	cvelist
EUVD	EUVD-2025-9629	3 Oct 202520:07	–	euvd
Github Security Blog	Next.js may leak x-middleware-subrequest-id to external hosts	2 Apr 202522:35	–	github
OSV	CLEANSTART-2026-IL36032 Security fixes for CVE-2025-30218, CVE-2025-49005, CVE-2025-65945, ghsa-2mjp-6q6p-2qxm, ghsa-33vc-wfww-vjfv, ghsa-43fc-jf86-j433, ghsa-4992-7rv2-5pvq, ghsa-4hjh-wcwx-xvwj, ghsa-554w-wpv2-vw27, ghsa-5gfm-wpxj-wjgq, ghsa-5jpx-9hw9-2fx4, ghsa-65ch-62r8-g69g, ghsa-869p-cjfg-cm3x, ghsa-968p-4wvh-cqc8, ghsa-9g9p-9gw9-jx7f, ghsa-9qr9-h5gf-34mp, ghsa-f269-vfmq-vjvj, ghsa-fjxv-7rqg-78g4, ghsa-g9mf-h72j-4rw9, ghsa-h25m-26qc-wcjf, ghsa-jmr7-xgp7-cmfj, ghsa-m7jm-9gc2-mpf2, ghsa-mwv6-3258-q52c, ghsa-rcmh-qjqh-p98v, ghsa-v9p9-hfj2-hcw8, ghsa-vrm6-8vpv-qv8q, ghsa-w37m-7fhw-fmv9, ghsa-xxjr-mmjv-4gpg applied in versions: 2.11.0-r0, 2.11.0-r2	1 Apr 202609:39	–	osv
OSV	CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts	2 Apr 202521:23	–	osv