Executive brief
Next.js is a popular framework used by developers to build web applications. A security flaw in its local development server could allow a malicious website to steal source code from a developer's computer while they are working on a project. This risk only exists during active development sessions and does not affect live production websites.
Technical details
The Next.js development server (next dev) fails to validate the 'Origin' header for WebSocket connections and certain script resources when the App Router is enabled. An attacker can exploit this by tricking a developer into visiting a malicious website while their local development server is running. This allows the attacker to initiate a Cross-Site WebSocket Hijacking (CSWSH) attack to interact with the local server or use Cross-Origin Script Inclusion to execute local development scripts within the attacker's origin. These methods can be used to extract internal component source code. The fix, available in versions 14.2.30 and 15.2.2, requires developers to manually opt-in by configuring 'allowedDevOrigins' in their Next.js configuration.
Affected products
- Vercel Next.js 13.0.0 to 14.2.29, 15.0.0 to 15.2.1
Timeline
- 2025-05-28: advisory: GHSA-3h52-269p-cp9r published by Vercel
- 2025-05-28: patched: Fixed in versions 14.2.30 and 15.2.2
- 2025-05-30: disclosed: CVE-2025-48068 assigned