Next.js Middleware Subrequest ID Leakage Vulnerability

A vulnerability exists in Next.js Middleware that allows the `x-middleware-subrequest-id` to be sent to third-party hosts, potentially leading to unintended information disclosure. This issue arises because the subrequest ID, intended for internal use, is automatically included in fetch requests to external services, regardless of the host. The vulnerability affects Next.js versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Impact

Exploitation of this vulnerability could result in the unintended leakage of the `x-middleware-subrequest-id` to external hosts, which may be misused if the third party is controlled by an attacker.

Remediation

Users are advised to update Next.js to version 12.3.6, 13.5.10, 14.2.26, or 15.2.4. Vercel customers are already protected by platform mitigations.