Next.js Middleware/Proxy Cache Poisoning via x-nextjs-data (CVE-2025-44572)

Vulnerability Overview Title: Middleware / Proxy redirects can be cache-poisoned CVE ID: CVE-2025-44572 CVSS Score: 3.7 / 10 (Low) Release Date: 2 weeks ago Affected Versions: (npm): and Fixed Versions: (npm): and --- Impact Scope 1. Attack Scenarios: - Applications using middleware or proxy redirects. - Deployed behind a caching CDN or reverse proxy. - Configured to cache 3xx responses for specific paths without distinguishing between internal data requests and normal user requests. 2. Attack Method: - An external client can send a normal request containing the header, tricking the middleware/proxy into treating it as a data request and replacing the standard redirect response. - If the application is deployed behind a caching CDN or reverse proxy, the attacker can cache this malicious redirect response. Subsequent visitors will then receive the cached malicious redirect, leading to service unavailability. 3. Consequences: - Cache Poisoning. - Denial of Service. --- Remediation 1. Version Upgrade: - Upgrade to (npm) version or . 2. Temporary Mitigation: - Configure the CDN or reverse proxy to include the request header in the cache key, thereby distinguishing internal data requests from normal requests. --- Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: Low Weakness: - CWE-349

Goal Reached Thanks to every supporter — we hit 100%!

Next.js Middleware/Proxy Cache Poisoning via x-nextjs-data (CVE-2025-44572)

More from this source