NCSC Urges Users to Patch Next.js Flaw Immediately
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-29927 | Middleware Authorization Bypass in Vercel Next.js (CVE-2025-29927) CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching. Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation. | 9.1 | 99% |
| masspotentially millions of Next.js deployments worldwide, with plausibly hundreds of thousands of sites/apps actually exposed (only those using middleware for… |
Full article353 words · extracted from infosecurity-magazine.com · click to collapse
The UK’s leading cybersecurity agency has urged users of a popular open source web development framework to patch a critical vulnerability immediately.
The National Cyber Security Centre (NCSC) warned in a post on Friday of an authorization bypass vulnerability present in Next.js, a React-based framework used to build full-stack web applications across the globe.
“An attacker may be able to exploit this vulnerability by sending an external request to the system that the system treats as an internal request, bypassing authorization checks and giving unauthorised access to sensitive data,” it explained.
“Proof-of-concept exploits for this vulnerability are widely and freely available.”
CVE-2025-29927 was fixed by the Next.js maintainers on March 22, after being responsibly and privately reported to the team back in February.
“Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops,” it explained.
“The security report showed it was possible to skip running middleware, which could allow requests to skip critical checks – such as authorization cookie validation – before reaching routes.”
The vulnerability impacts all versions of 13.x before 13.5.9; all versions of 14.x before 14.2.25; all versions of 15.x before 15.2.3; and all versions from 11.1.4 up to, but not including, 12.3.5.
“If updating to a fixed version is not feasible, the vendor has recommended that external user requests containing the ‘x-middleware-subrequest’ header be blocked from reaching your Next.js application,” the NCSC said.
“This should be a temporary measure until updating to the latest version is possible.”
The agency also urged organizations to monitor logs for potential attacks.
Rapid7 explained that, because the CVE in question affects an application framework and that middleware configurations can vary, so does the potential impact of the bug.
“Organizations should consider whether their applications are relying solely on the middleware for authentication,” it said.
“It may be that the application uses middleware, but is just acting as a front end to back-end APIs that are dealing with server-side authentication logic. Bypassing the front-end Next.js middleware would not affect the back end’s ability to authenticate users.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ncsc-urges-patch-nextjs-flaw/