-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | = 12.3.5 | 12.3.6 |
| next | npm | = 13.5.9 | 13.5.10 |
| next | npm | = 14.2.25 | 14.2.26 |
| next | npm | = 15.2.3 | 15.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key behaviors visible in the provided code snippets: 1) The middlewareSubrequestId is stored in global scope without proper isolation, and 2) The x-middleware-subrequest-id header is added to all fetch requests regardless of destination. The primary vulnerable function is the request handler that adds the header to outgoing requests (NextMiddleware.run), while the global storage mechanism (MiddlewareRequestHandler.processRequest) enables the leakage. These would appear in runtime profiles during middleware execution and external fetch operations.
A Semantic Attack on Google Gemini - Read the Latest Research