{"action":"Upgrade next to 12.3.6 or later.","affected":[{"fixed":"12.3.6","introduced":"12.3.5"},{"fixed":"13.5.10","introduced":"13.5.9"},{"fixed":"14.2.26","introduced":"14.2.25"},{"fixed":"15.2.4","introduced":"15.2.3"}],"component":"next","cve_ids":["CVE-2025-30218"],"ecosystem":"npm","epss":0.00423,"exploited":false,"fixed_versions":["12.3.6","13.5.10","14.2.26","15.2.4"],"ghsa_id":"GHSA-223j-4rm8-mrmf","id":"tcs_01M5KERJQ01X4998R168R34N54","modified_at":"2025-10-13T15:35:50Z","published_at":"2025-04-02T22:35:37Z","references":["https://osv.dev/vulnerability/GHSA-223j-4rm8-mrmf","https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf","https://nvd.nist.gov/vuln/detail/CVE-2025-30218","https://github.com/vercel/next.js","https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-223j-4rm8-mrmf","url":"https://osv.dev/vulnerability/GHSA-223j-4rm8-mrmf"},{"source":"nvd","source_id":"CVE-2025-30218","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30218"}],"summary":"Next.js may leak x-middleware-subrequest-id to external hosts"}