Critical Next.js Middleware Vulnerability Allows Attackers to Bypass Authorization

A severe vulnerability has been identified in Next.js, a popular React framework used for building web applications, under the designation CVE-2025-29927.

This critical flaw allows attackers to bypass security controls implemented by middleware, posing significant risks to authentication, authorization, and security header implementations, as per a report by Zeropath.

CVE-2025-29927: Overview

The exploit works by manipulating the x-middleware-subrequest header, enabling attackers to circumvent security checks.

For older versions of Next.js (pre-12.2), the header can be constructed as follows:

x-middleware-subrequest: pages/_middleware

In more recent versions, the header requires a repetitive pattern:

x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

For setups using the src directory, it is necessary to replace middleware with src/middleware.

Affected Products

The following table highlights the versions of Next.js that are affected by this vulnerability:

Product Version	Affected Versions
Next.js 11.x	11.1.4 and later (unpatched)
Next.js 12.x	Unpatched versions
Next.js 13.x	13.5.6 and earlier (unpatched)
Next.js 14.x	Before 14.2.25
Next.js 15.x	Before 15.2.3

Mitigation Strategies

Users are advised to take immediate action to mitigate the risks associated with CVE-2025-29927:

1. Update Next.js Version:
   • For those using Next.js 15.x, update to version 15.2.3 or later.
   • For those on Next.js 14.x, update to version 14.2.25 or later.
2. Edge/Proxy Header Blocking:
   • If updating is not feasible, block the x-middleware-subrequest header at your edge or proxy level. Important: Do not attempt to block the header within the middleware itself.

By promptly implementing these measures, users can protect their applications from potential exploits of this critical vulnerability.

The discovery of CVE-2025-29927 emphasizes the importance of staying vigilant and keeping software up to date, especially for widely used frameworks like Next.js.

As always, security updates should be prioritized to safeguard against emerging threats and ensure a secure digital environment.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free