Next.js Dev Server Vulnerability Leads to Developer Data Exposure

A recently disclosed vulnerability, CVE-2025-48068, has raised concerns among developers using the popular Next.js framework.

This flaw, affecting versions 13.0.0 through 15.2.1 when the App Router is enabled, allows attackers to exploit the development server via Cross-site WebSocket Hijacking (CSWSH), potentially exposing sensitive application source code.

The issue has been addressed in version 15.2.2, but understanding its technical implications and mitigation strategies remains essential for the developer community.

How CSWSH Targets Next.js

The vulnerability stems from a lack of origin verification in the WebSocket server of the Next.js development environment.

When running the dev server (typically using npm run dev or next dev), a malicious website can establish a WebSocket connection to localhost and access the component source code if the project uses the App Router feature.

This attack, known as Cross-site WebSocket Hijacking (CSWSH), takes advantage of browsers’ ability to initiate WebSocket connections from any website, unless the server explicitly checks the origin header.

Technical Example:

javascript// Vulnerable WebSocket server (simplified)
const ws = new WebSocket('ws://localhost:3000/_next/webpack-hmr');
// No origin verification in the dev server

If a developer visits a malicious site while their Next.js dev server is running, the attacker’s script can connect to the local server and extract internal source code, specifically from projects using the App Router (which requires experimental.appDir = true in versions <13.4).

Impact, Scope, and Mitigation Strategies

The vulnerability is limited to local development environments and does not affect production deployments, including those hosted on Vercel.

However, the risk is significant: unauthorized parties could access proprietary code or sensitive logic if the attack is successful.

Key Details:

Affected Software	Affected Versions	Patched Version
npm/next	>=13.0.0 <15.2.2	15.2.2

Recommended Actions:

• Upgrade: Update Next.js to version 15.2.2 or later, which introduces strict origin checks on the development WebSocket server.
• Workarounds:
  • Avoid browsing untrusted websites while running the local dev server.
  • Use local firewall or proxy rules to block unauthorized WebSocket access to localhost.
  • Leverage the allowedDevOrigins configuration in next.config.js to specify which origins can connect during development.

Example Configuration:

javascript// next.config.js
module.exports = {
  allowedDevOrigins: ['local-origin.dev', '*.local-origin.dev'],
};

This setting restricts WebSocket connections to trusted origins, mitigating the risk while maintaining development flexibility.

Lessons Learned and Future Safeguards

The CVE-2025-48068 incident highlights the importance of secure defaults and rigorous origin checks in development tooling.

While the vulnerability is reminiscent of CVE-2018-14732, its scope is strictly limited to local environments and the experimental App Router feature.

Developers are urged to adopt the latest patched version and review their development practices, particularly regarding interactions with untrusted web content during active dev sessions.

Summary Table:

Technical Term	Definition
CSWSH	Cross-site WebSocket Hijacking, where a malicious site hijacks a WebSocket.
App Router	Next.js feature for routing, affected by this vulnerability.
allowedDevOrigins	Next.js config option to limit allowed WebSocket origins in dev mode.

Credit: The vulnerability was responsibly disclosed by sapphi-red and Radman Siddiki, ensuring a timely fix for the Next.js community.

By upgrading promptly and configuring development environments securely, developers can minimize the risk of similar exploits in the future.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!