Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

The version of Next.js installed on the remote host is prior to 14.2.32 or 15.x prior to 15.4.7. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in self-hosted applications when request headers are directly passed into NextResponse.next() in Middleware. This issue is fixed in versions 14.2.32 and 15.4.7. (CVE-2025-57822)

- A content injection vulnerability in the Image Optimization API. This issue is fixed in versions 14.2.31 and 15.4.5. (CVE-2025-55173)

- A cache key confusion vulnerability in the Image Optimization API routes. This issue is fixed in versions 14.2.31 and 15.4.5. (CVE-2025-57752)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and
    15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-
    hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in
    Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted
    environments are strongly encouraged to upgrade and verify correct usage of the next() function.
    (CVE-2025-57822)

ID	Name	Product	Family	Type	Severity
115780	Next.js 15.x < 15.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115779	Next.js 10.0.0 < 14.2.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
435156	SCA: security update for next (GHSA-4342-x723-ch2f)	Tenable Cloud Security	SCA Checks	Local	high
435156	SCA: security update for next (GHSA-4342-x723-ch2f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-57822

high

Tenable Plugins

high

high

high

high