Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-48068
Good to know:
Date: May 29, 2025
Summary This vulnerability is similar to CVE-2018-14732. When running a Next.js server locally (e.g. through "npm run dev"), the WebSocket server is vulnerable to the Cross-site WebSocket hijacking (CSWSH) attack. and a bad actor can access the source code of client components, if a user was to visit a malicious link while having the Next.js dev server running. Impact If a user is running a Next.js server locally (e.g. "npm run dev"), and they were to browse to a malicious website, the malicious website may be able to access the source code of the Next.js app. This vulnerability only affects applications making use of App Router. Note: App Router was experimental requiring "experimental.appDir = true" in versions ">=13.0.0" to "<13.4".
Severity Score
Severity Score
Weakness Type (CWE)
Missing Origin Validation in WebSockets
CWE-1385Top Fix
Upgrade Version
Upgrade to version next - 15.2.2;next - 14.2.30;next - 14.2.30;https://github.com/vercel/next.js.git - v15.2.2;https://github.com/vercel/next.js.git - v14.2.30
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | NONE |
| Availability (A): | NONE |