Researchers raise alarm about critical Next.js vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-29927 | Middleware Authorization Bypass in Vercel Next.js (CVE-2025-29927) CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching. Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation. | 9.1 | 99% |
| masspotentially millions of Next.js deployments worldwide, with plausibly hundreds of thousands of sites/apps actually exposed (only those using middleware for… |
Full article645 words · extracted from cyberscoop.com · click to collapse
Get our latest cybersecurity news first on Google.
The software defect in the widely used open-source JavaScript framework allows attackers to bypass middleware-based authorization.
Listen to this article
0:00
Learn more.
Researchers warn that attackers could exploit a recently discovered critical vulnerability in the open-source JavaScript framework Next.js to bypass authorization in middleware and gain access to targeted systems.
Vercel, the San Francisco-based company that created and maintains Next.js, released a patch for CVE-2025-29927 in Next.js 15.2.3 on March 18 and published a security advisory on March 21. Researchers Allam Rachid and Allam Yasser discovered the vulnerability, which has a base score of 9.1 on the CVSS scale, and reported it to Vercel on Feb. 27.
Next.js, initially released in late 2016, is widely used among developers and currently downloaded more than 9 million times per week. The vulnerability affects Next.js applications using middleware for authorization or security checks.
“We are not aware of any active exploits,” Vercel CISO Ty Sbano told CyberScoop in an email. “If someone hosts a Next.js application outside of Vercel, we would not have visibility into runtime or their analytics. Platforms like Vercel and Netlify were not affected.”
Vercel doesn’t know how many Next.js applications are running on self-hosted infrastructure.
The way attackers could take advantage of the flaw lies in an improper authentication defect. By using a simple token or piece of code to trick the system, it could allow an attacker to bypass security checks meant to control access and reach parts of the application that should be restricted, Rachid explained in a blog post about his discovery and research.
Rachid also demonstrated how the vulnerability can be exploited to achieve content security bypass and denial-of-service cache poisoning.
“This vulnerability has been present for several years in the Next.js source code, evolving with the middleware and its changes over the versions,” Rachid wrote in the blog post. “A critical vulnerability can occur in any software, but when it affects one of the most popular frameworks, it becomes particularly dangerous and can have severe consequences for the broader ecosystem.”
Concerns regarding Vercel’s response to the vulnerability and delayed disclosure linger. The company published a security advisory Friday, three days after it released a patched version of Next.js, and published a changelog and blog post about the matter Saturday.
“There has been understandable concern that our communication with partners during this incident did not meet our typical standards,” Sbano said.
“While our teams had verified the issue did not impact most infrastructure platforms, we failed to proactively share that context quickly enough,” he continued. “We’re already working on ways we can improve how we share information moving forward.”
Latest Podcasts
Government
FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching
Feds accuse China of ‘systematic’ distillation of U.S. AI models
CIA’s Michael Ellis says cyber intelligence is changing how the agency operates
The G7 tells industry to hurry up and prep for post-quantum encryption
Technology
Threats
Policy
Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots
‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help
Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities
Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/nextjs-critical-vulnerability-open-source-vercel/