Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Next.js Server-Side Request Forgery (SSRF) Vulnerability - CVE-2025-57822 - Vulnerability Database
Next.js

Next.js Server-Side Request Forgery (SSRF) Vulnerability - CVE-2025-57822

High
Reference: CVE-2025-57822
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-57822
Title: Next.js Server-Side Request Forgery (SSRF) Vulnerability
Overview:

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7 when next() was used without explicitly passing the request object it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.