Attackers can bypass middleware auth checks by exploiting critical Next.js flaw

CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching.

Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation.