EUVD-2025-9629

Malicious code in bioql PyPI...

Next.js may leak x-middleware-subrequest-id to external hosts

Summary In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more here. Credit Thank you to Jinseo Kim kjsman and RyotaK GMO Flat...

CVE-2025-30218

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host ...

CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host ...

CVE-2025-30218: Exposure of Sensitive Information to an Unauthorized Actor

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host ...

PT-2025-14552

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 12.3.6 Next.js versions prior to 13.5.10 Next.js versions prior to 14.2.26 Next.js versions prior to 15.2.4 Description The issue concerns the leakage of the x-middleware-subrequest-id across multiple incoming request...