CVE-2025-48068 - CVE House
Back to Database
Status published Low CVE-2025-48068

Information exposure in Next.js dev server due to lack of origin verification

Vulnerability Description

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48068

Credits & Attribution

No credits recorded in the NVD database.

References

More from vercel

View All →
CVE-2025-7074
vercel hyper rimraf-standalone.js ignoreMap redos
Medium 5.3
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with...
Medium 5.9
CVE-2025-59471
A denial of service vulnerability exists in self-hosted Next.js applications...
Medium 5.9
CVE-2025-57822
Next.js Improper Middleware Redirect Handling Leads to SSRF
Medium 6.5
CVE-2025-57752
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
Medium 6.2

Affected Vendor

Affected Software

next.js
Vulnerable Versions:
>= 13.0, < 14.2.30, >= 15.0.0, < 15.2.2

Timeline

Official Publish: May 30th, 2025
Last Modified: June 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1385

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.