CVE-2025-30218: Next.js may leak x-middleware-subrequest-id to external hosts

April 2, 2025 (updated October 31, 2025)

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.

Learn more here.

References

github.com/advisories/GHSA-223j-4rm8-mrmf
github.com/vercel/next.js
github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf
nvd.nist.gov/vuln/detail/CVE-2025-30218
vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O

Code Behaviors & Features

Detect and mitigate CVE-2025-30218 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →