GHSA-3h52-269p-cp9r

Suggest an improvement
Source
https://github.com/advisories/GHSA-3h52-269p-cp9r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-3h52-269p-cp9r
Aliases
Published
2025-05-28T21:52:13Z
Modified
2025-06-13T14:41:21Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
Information exposure in Next.js dev server due to lack of origin verification
Details

Summary

A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.

Learn more: https://vercel.com/changelog/cve-2025-48068

Credit

Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.

Database specific 
{
    "github_reviewed_at": "2025-05-28T21:52:13Z",
    "severity": "LOW",
    "nvd_published_at": "2025-05-30T04:15:48Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1385"
    ]
}
References

Affected packages

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
15.0.0
Fixed
15.2.2

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
13.0
Fixed
14.2.30