CVE-2025-29927: Authorization Bypass in Next.js Middleware

Published Mar 21, 2025
·
Updated

Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

- Allam Rachid (zhero;) - Allam Yasser (inzo)

Other sources

Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

- Allam Rachid (zhero;) - Allam Yasser (inzo)

GitHub

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

NVD

Affected Software

10 affected componentsFixes available
Vercel Next.js<14.2.25, <15.2.3
npm/next>=11.1.4<12.3.5
12.3.5
npm/next>=15.0.0<15.2.3
15.2.3
npm/next>=14.0.0<14.2.25
14.2.25
npm/next>=13.0.0<13.5.9
13.5.9
Vercel Next.js Node.js>=11.1.4<12.3.5
Vercel Next.js Node.js>=13.0.0<13.5.9
Vercel Next.js Node.js>=14.0.0<14.2.25
Vercel Next.js Node.js>=15.0.0<15.2.3
npm/next>=12.0.0<12.3.5
12.3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 12.3.5
  2. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 15.2.3
  3. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 14.2.25
  4. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 13.5.9
  5. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 12.3.5
  6. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 13.5.9
  7. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 14.2.25
  8. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 15.2.3
  9. Compensating control

    If patching to a safe version is infeasible, prevent external user requests that contain the `x-middleware-subrequest` header from reaching your Next.js application.

Event History

Mar 21, 2025
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:20 PM
Data Sourced
via GitHub·03:20 PM
DescriptionSeverityWeaknessAffected Software
Mar 24, 2025
News Published
via BleepingComputer·04:15 PM
News Published
via BleepingComputer·04:16 PM
Apr 5, 2025
Exploit Published
12:00 AM
Known Exploited
01:46 PM

Frequently Asked Questions

1

What is the severity of CVE-2025-29927?

CVE-2025-29927 has been classified as a high severity vulnerability due to the potential for unauthorized access in Next.js applications.

2

How do I fix CVE-2025-29927?

To fix CVE-2025-29927, update to Next.js version 14.2.25 or 15.2.3 or later.

3

What versions of Next.js are affected by CVE-2025-29927?

CVE-2025-29927 affects Next.js versions prior to 14.2.25 and 15.2.3.

4

What does CVE-2025-29927 allow an attacker to do?

CVE-2025-29927 allows attackers to bypass authorization checks in Next.js applications when these checks are performed in middleware.

5

Are there any workarounds for CVE-2025-29927 if I cannot update?

If updating is not possible, implementing additional server-side checks for authorization in app logic can serve as a temporary workaround for CVE-2025-29927.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203