CVE-2025-57822

CVE-2025-57822 is a vulnerability affecting Next.js, a React framework, in versions prior to 14.2.32 and 15.4.7. It involves a Server-Side Request Forgery (SSRF) risk due to improper handling of the `NextResponse.next()` function within middleware. The issue arises when request headers are directly passed into `NextResponse.next()` without explicitly passing the request object. In self-hosted applications with custom middleware logic, this could allow an attacker to influence internal requests and potentially access sensitive internal resources by crafting requests with user-controlled headers (e.g., Location) that are forwarded or interpreted without validation. The vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7 by updating the internal middleware logic to prevent unsafe fallback behavior when the request object is omitted from the `next()` call.