CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4787 vulnerabilities reference this CWE, most recent first.
GHSA-3XXR-729F-X6V9
Vulnerability from github – Published: 2022-03-15 00:00 – Updated: 2022-03-23 00:00IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.
{
"affected": [],
"aliases": [
"CVE-2021-39051"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-14T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.",
"id": "GHSA-3xxr-729f-x6v9",
"modified": "2022-03-23T00:00:48Z",
"published": "2022-03-15T00:00:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39051"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214441"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6562479"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4233-7Q5Q-M7P6
Vulnerability from github – Published: 2023-11-27 23:30 – Updated: 2023-11-27 23:30Summary
A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set a malicious tld, causing the application to return unsafe URLs pointing towards local resources.
Details
The translateOptions.tld field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the translateOptions to set the tld to a payload such as @127.0.0.1. This causes the full URL to become https://translate.google.@127.0.0.1/..., where translate.google. is the username used to connect to localhost.
PoC
Imagine a server running the following code (closely mimicking the code present in the package's README):
const express = require('express');
const { generateRequestUrl, normaliseResponse } = require('google-translate-api-browser');
const https = require('https');
const app = express();
app.use(express.json());
app.post('/translate', async (req, res) => {
const { text, options } = req.body;
const url = generateRequestUrl(text, options);
https.get(url, (resp) => {
let data = '';
resp.on('data', (chunk) => {
data += chunk;
});
resp.on('end', () => {
res.json(normaliseResponse(JSON.parse(data)));
});
}).on("error", (err) => {
console.log("Error: " + err.message);
});
});
const port = 3000;
app.listen(port, () => {
console.log(`Server is running on port ${port}`);
});
An attacker can then send the following POST request to /translate:
POST /translate HTTP/1.1
Host: localhost:3000
Content-Type: application/json
Content-Length: 51
{"text":"Hello","options": {"tld": "@127.0.0.1"} }
This will cause a request to be sent to the localhost of the server running the Node application.
Impact
An attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "google-translate-api-browser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-48711"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-27T23:30:14Z",
"nvd_published_at": "2023-11-24T17:15:07Z",
"severity": "LOW"
},
"details": "### Summary\nA Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources.\n\n### Details\nThe `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://translate.google.@127.0.0.1/...`, where `translate.google.` is the username used to connect to localhost.\n\n### PoC\nImagine a server running the following code (closely mimicking the code present in the package\u0027s README):\n```javascript\nconst express = require(\u0027express\u0027);\nconst { generateRequestUrl, normaliseResponse } = require(\u0027google-translate-api-browser\u0027);\nconst https = require(\u0027https\u0027);\n\nconst app = express();\napp.use(express.json());\n\napp.post(\u0027/translate\u0027, async (req, res) =\u003e {\n const { text, options } = req.body;\n\n const url = generateRequestUrl(text, options);\n\n https.get(url, (resp) =\u003e {\n let data = \u0027\u0027;\n \n resp.on(\u0027data\u0027, (chunk) =\u003e {\n data += chunk;\n });\n \n resp.on(\u0027end\u0027, () =\u003e {\n res.json(normaliseResponse(JSON.parse(data)));\n });\n }).on(\"error\", (err) =\u003e {\n console.log(\"Error: \" + err.message);\n });\n});\n\nconst port = 3000;\napp.listen(port, () =\u003e {\n console.log(`Server is running on port ${port}`);\n});\n```\n\nAn attacker can then send the following POST request to `/translate`:\n```\nPOST /translate HTTP/1.1\nHost: localhost:3000\nContent-Type: application/json\nContent-Length: 51\n\n{\"text\":\"Hello\",\"options\": {\"tld\": \"@127.0.0.1\"} }\n```\n\nThis will cause a request to be sent to the localhost of the server running the Node application.\n\n### Impact\nAn attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability.\n",
"id": "GHSA-4233-7q5q-m7p6",
"modified": "2023-11-27T23:30:14Z",
"published": "2023-11-27T23:30:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cjvnjde/google-translate-api-browser/security/advisories/GHSA-4233-7q5q-m7p6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48711"
},
{
"type": "WEB",
"url": "https://github.com/cjvnjde/google-translate-api-browser/commit/33c2eac4a21c6504409e7b06dd16e6346f93d34b"
},
{
"type": "PACKAGE",
"url": "https://github.com/cjvnjde/google-translate-api-browser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability"
}
GHSA-423G-PPH2-4PP5
Vulnerability from github – Published: 2026-05-02 06:30 – Updated: 2026-05-02 06:30The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2026-6812"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-02T06:16:04Z",
"severity": "MODERATE"
},
"details": "The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-423g-pph2-4pp5",
"modified": "2026-05-02T06:30:24Z",
"published": "2026-05-02T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6812"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ona/tags/1.23.2/inc/admin/theme-admin.php#L688"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ona/tags/1.23.2/inc/admin/theme-admin.php#L694"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ona/trunk/inc/admin/theme-admin.php#L688"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ona/trunk/inc/admin/theme-admin.php#L694"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0acb365c-b5f2-4377-875b-69278a8ff96e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-425J-2MFW-73XX
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.
{
"affected": [],
"aliases": [
"CVE-2020-28978"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-30T14:15:00Z",
"severity": "MODERATE"
},
"details": "The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.",
"id": "GHSA-425j-2mfw-73xx",
"modified": "2022-05-24T17:35:15Z",
"published": "2022-05-24T17:35:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28978"
},
{
"type": "WEB",
"url": "https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0"
},
{
"type": "WEB",
"url": "https://github.com/CantoDAM/Canto-Wordpress-Plugin"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/canto/#developers"
},
{
"type": "WEB",
"url": "https://www.canto.com/integrations/wordpress"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-427P-XGCR-J3HR
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 21:30Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.
{
"affected": [],
"aliases": [
"CVE-2026-25310"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T09:16:15Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through \u003c= 2.0.0.",
"id": "GHSA-427p-xgcr-j3hr",
"modified": "2026-02-19T21:30:44Z",
"published": "2026-02-19T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25310"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/extend-link/vulnerability/wordpress-extend-link-plugin-2-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-429M-9874-RX9W
Vulnerability from github – Published: 2026-02-27 00:31 – Updated: 2026-03-04 21:06A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java of the component Whois. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.github.psi-probe:psi-probe-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-3270"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T21:06:50Z",
"nvd_published_at": "2026-02-27T00:16:58Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java of the component Whois. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-429m-9874-rx9w",
"modified": "2026-03-04T21:06:50Z",
"published": "2026-02-27T00:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3270"
},
{
"type": "WEB",
"url": "https://github.com/AnalogyC0de/public_exp/issues/12"
},
{
"type": "PACKAGE",
"url": "https://github.com/psi-probe/psi-probe"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.347994"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.347994"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.758666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "PSI Probe vulnerable to Server-Side Request Forgery"
}
GHSA-42FC-7W97-8VRC
Vulnerability from github – Published: 2026-05-05 19:32 – Updated: 2026-05-05 19:32Impact
The PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram.
This issue affects all versions of the Plant UML Macro extension till version 2.4 included.
Patches
Version 2.4.1 of the Plant UML Macro extension fixes the issue by verifying if the supplied server domain matches one of the trusted domain configured inside of XWiki.
Workarounds
Protect the XWiki server by placing it in a DMZ so that it cannot access any other internal servers.
Resources
The issue was fixed in PLANTUML-25 by the commit c8b19bda93058794e04c8862fc7ca85c59b5fe5c.
For more information
If there are any questions or comments about this advisory: * Open an issue in JIRA XWiki.org * Send an email to Security Mailing List
Attribution
The issue was reported by Łukasz Rybak.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.contrib.plantuml:macro-plantuml-macro"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42140"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T19:32:57Z",
"nvd_published_at": "2026-05-04T18:16:31Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe [PlantUML Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/PlantUML+Macro) is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the `server` parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address\u00a0or a malicious external URL. The XWiki server will attempt to connect to this URL to \"render\" the diagram.\n\nThis issue affects all versions of the Plant UML Macro extension till version 2.4 included.\n\n### Patches\n\nVersion 2.4.1 of the Plant UML Macro extension fixes the issue by verifying if the supplied server domain matches one of the [trusted domain configured inside of XWiki](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Configuration/#HTrusteddomains).\n\n### Workarounds\n\nProtect the XWiki server by placing it in a DMZ so that it cannot access any other internal servers.\n\n### Resources\n\nThe issue was fixed in [PLANTUML-25](https://jira.xwiki.org/browse/PLANTUML-25) by the commit [c8b19bda93058794e04c8862fc7ca85c59b5fe5c](https://github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5c).\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* Open an issue in [JIRA XWiki.org](https://jira.xwiki.org/)\n* Send an email to [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThe issue was reported by \u0141ukasz Rybak.",
"id": "GHSA-42fc-7w97-8vrc",
"modified": "2026-05-05T19:32:57Z",
"published": "2026-05-05T19:32:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki-contrib/macro-plantuml/security/advisories/GHSA-42fc-7w97-8vrc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42140"
},
{
"type": "WEB",
"url": "https://github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5c"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki-contrib/macro-plantuml"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/PLANTUML-25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via \u0027server\u0027 parameter"
}
GHSA-42H4-5JCF-F7XW
Vulnerability from github – Published: 2024-11-22 21:32 – Updated: 2024-11-22 21:32A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-11618"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T19:15:05Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-42h4-5jcf-f7xw",
"modified": "2024-11-22T21:32:15Z",
"published": "2024-11-22T21:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11618"
},
{
"type": "WEB",
"url": "https://github.com/br484/br484.github.io/blob/main/archives/WEB/CVE%20-%20IPC%20Unigy%20-%20ingles.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.285841"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.285841"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.441817"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-42HF-HP85-6R5F
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
{
"affected": [],
"aliases": [
"CVE-2020-24149"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T14:15:00Z",
"severity": "HIGH"
},
"details": "Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.",
"id": "GHSA-42hf-hp85-6r5f",
"modified": "2022-05-24T19:07:04Z",
"published": "2022-05-24T19:07:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24149"
},
{
"type": "WEB",
"url": "https://github.com/secwx/research/blob/main/cve/CVE-2020-24149.md"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/podcast-importer-secondline/#developers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4342-X723-CH2F
Vulnerability from github – Published: 2025-08-29 21:33 – Updated: 2025-09-11 15:41A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.9"
},
{
"fixed": "14.2.32"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0-canary.0"
},
{
"fixed": "15.4.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57822"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-29T21:33:09Z",
"nvd_published_at": "2025-08-29T22:15:32Z",
"severity": "MODERATE"
},
"details": "A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.\n\nAll users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)",
"id": "GHSA-4342-x723-ch2f",
"modified": "2025-09-11T15:41:02Z",
"published": "2025-08-29T21:33:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57822"
},
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8"
},
{
"type": "PACKAGE",
"url": "https://github.com/vercel/next.js"
},
{
"type": "WEB",
"url": "https://vercel.com/changelog/cve-2025-57822"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Next.js Improper Middleware Redirect Handling Leads to SSRF"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.