CVE-2025-48068
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.
https://nvd.nist.gov/vuln/detail/CVE-2025-48068
Categories
CWE-1385 : Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid. this term is used for attacks that exploit this weakness Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake. Use a randomized CSRF token to verify requests. Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'. Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function. Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this. Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set. Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc. web console for SIEM product does not check Origin header, allowing Cross Site WebSocket Hijacking (CSWH) Chain: gaming client attempts to validate the Origin header, but only uses a substring, allowing Cross-Site WebSocket hijacking by forcing requests from an origin whose hostname is a substring of the valid origin. WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1:3123/ connection. WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1/ connection to a randomized port number. WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1:8080/ connection.
References
security-advisories@github.com
CPE
| cpe | start | end |
|---|
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
