Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-29927 | Middleware Authorization Bypass in Vercel Next.js (CVE-2025-29927) CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching. Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation. | 9.1 | 99% |
| masspotentially millions of Next.js deployments worldwide, with plausibly hundreds of thousands of sites/apps actually exposed (only those using middleware for… |
Full article674 words · extracted from helpnetsecurity.com · click to collapse
A critical vulnerability (CVE-2025-29927) in the open source Next.js framework can be exploited by attackers to bypass authorization checks and gain unauthorized access to web pages they should no have access to (e.g., the web app’s admin panel).
Vercel – the Cloud platform-as-a-Service company that develops the popular framework – has released security updates fixing it, and has advised users to upgrade as soon as possible.
What is Next.js and how does CVE-2025-29927 manifest?
Next.js is a full-stack framework that makes building and shipping web applications easier, by helping with page rendering, routing, performance and SEO optimization, etc.
Next.js is built on React, a JavaScript library that is used for building web user interfaces out of individual, reusable components, and together they are used to quickly build full-stack, production-ready applications.
Next.js uses its own middleware to processes requests, protect routes, add security headers to responses, and handle things like user authentication and user redirection (e.g., based on geolocation, their session / authorization cookies, etc.).
CVE-2025-29927 allows attackers to bypass middleware security controls by sending a request with a specially crafted x-middleware-subrequest header to the target application.
“If we add the x-middleware-subrequest header with the correct value to our request, the middleware – whatever its purpose – will be completely ignored, and the request will be forwarded via NextResponse.next() and will complete its journey to its original destination without the middleware having any impact/influence on it. The header and its value act as a universal key allowing rules to be overridden,” explained Rachid Allam and Yasser Allam, the security researchers who discovered the vulnerability.
They reported the vulnerability privately to Vercel, whose developers pushed out temporary patches on March 14, 2025, and then started releasing new, fixed versions of the various branches of the Next.js framework a few days later.
What to do?
Next.js is widely used by enterprises, including the likes of Twitch, Spotify, Binance, Hulu, TikTok, OpenAI, and many others.
RunZero CEO HD Moore (of Metasploit fame) pointed out that the Shodan search engine currenly shows over 300,000 services with the `X-Powered-By: Next.js` header alone.
All versions of Next.js were found to be vulnerable to CVE-2025-29927. The issue has been fixed in versions 15.2.3, 14.2.25, 13.5.9 and 12.3.5.
According to the Next.js maintainers, the vulnerability affects self-hosted Next.js applications using middleware, especially if they rely only on the middleware for authentication or security checks. Applications hosted on the Vercel and Netlify cloud platforms are not affected, and neither are applications deployed as static exports (because middleware is not executed).
“If patching to a safe version is infeasible, it is recommended that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application,” the framework maintainers advised.
ProjectDiscovery has provided advice on the different ways this mitigation can be implemented.
Cloudflare has made available a rule that blocks such requests for its managed WAF (web application firewall) customers, and has advised others on how to create a custom one.
UPDATE (March 31, 2025, 06:10 a.m. ET):
The UK National Cyber Security Centre (NCSC) has encouraged UK organizations to mitigate CVE-2025-29927 as “proof-of-concept exploits for this vulnerability are widely and freely available.”
But Caitlin Condon, vulnerability research director at Rapid7, said recently that CVE-2025-29927 may not end up being “world-ending.”
“The fact that the bug isn’t known to have been successfully exploited in the wild despite the huge amount of media and industry attention it’s received sure feels like a reasonable early indicator that it’s unlikely to be broadly exploitable (classic framework vuln), and may not have any easily identifiable remote attack vectors at all,” she noted.
“The most severe potential impact likely comes in the form of authentication bypass, but would still be highly application-dependent — the impact of bypassing authentication for a hobbyist ‘To do list’ application is very different from theoretically bypassing authentication in an enterprise application utilising Next.js,” Rapid7’s Calum Hutton explained.
This doesn’t mean that organizations should not check whether their applications are vulnerable and mitigate the risk as soon as possible, though.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/03/24/critical-next-js-auth-bypass-vulnerability-opens-web-apps-to-compromise-cve-2025-29927/