CVE-2025-29927: Authorization Bypass in Next.js Middleware
Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.
Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround.
Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.
Workaround If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.
Credits
- Allam Rachid (zhero;) - Allam Yasser (inzo)
Other sources
Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.
Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround.
Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.
Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.
Credits
- Allam Rachid (zhero;) - Allam Yasser (inzo)
— GitHub
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 12.3.5 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.2.3 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 14.2.25 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 13.5.9 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 12.3.5 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 13.5.9 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 14.2.25 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.2.3 - Compensating control
If patching to a safe version is infeasible, prevent external user requests that contain the `x-middleware-subrequest` header from reaching your Next.js application.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29927?
CVE-2025-29927 has been classified as a high severity vulnerability due to the potential for unauthorized access in Next.js applications.
How do I fix CVE-2025-29927?
To fix CVE-2025-29927, update to Next.js version 14.2.25 or 15.2.3 or later.
What versions of Next.js are affected by CVE-2025-29927?
CVE-2025-29927 affects Next.js versions prior to 14.2.25 and 15.2.3.
What does CVE-2025-29927 allow an attacker to do?
CVE-2025-29927 allows attackers to bypass authorization checks in Next.js applications when these checks are performed in middleware.
Are there any workarounds for CVE-2025-29927 if I cannot update?
If updating is not possible, implementing additional server-side checks for authorization in app logic can serve as a temporary workaround for CVE-2025-29927.