{"id":"CVE-2025-29927","published":"2025-03-21T14:34:49Z","modified":"2025-04-08T15:17:05Z","title":"Authorization Bypass in Next.js Middleware","vendor":"vercel","product":"next.js","tier":"core","eol":null,"affectedVersions":[{"vendor":"vercel","product":"next.js","versions":[">= 11.1.4, < 12.3.5",">= 14.0.0, < 14.2.25",">= 15.0.0, < 15.2.3",">= 13.0.0, < 13.5.9"]}],"description":{"text":"Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the middleware of Next.js, the React framework for full-stack web applications, allows authorization checks performed in middleware to be bypassed. An unauthenticated remote attacker over the network can exploit it without any user interaction or special configuration, simply by sending requests containing the x-middleware-subrequest header.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:32Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.99225,"percentile":0.99936,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-03-28","exploitedFirstSeen":"2025-03-28","ransomware":false,"evidence":[{"url":"https://securitylabs.datadoghq.com/articles/nextjs-middleware-auth-bypass/","date":"2025-03-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-24&host_type=src&vulnerability=cve-2025-29927","date":"2025-04-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-25&host_type=src&vulnerability=cve-2025-29927","date":"2025-04-25"},{"url":"https://censys.com/blog/scouting-a-threat-actor","date":"2025-04-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-21&host_type=src&vulnerability=cve-2025-29927","date":"2025-05-21"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-29927","date":"2025-06-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-03&host_type=src&vulnerability=cve-2025-29927","date":"2025-10-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-14&host_type=src&vulnerability=cve-2025-29927","date":"2025-10-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-22&host_type=src&vulnerability=cve-2025-29927","date":"2025-10-22"},{"url":"https://beelzebub.ai/blog/threat-huntinga-analysis-of-a-nextjs-exploit-campaign/","date":"2025-12-15"}],"evidenceTotal":83,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2","tags":["x_refsource_MISC"]},{"url":"https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48","tags":["x_refsource_MISC"]},{"url":"https://github.com/vercel/next.js/releases/tag/v12.3.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/vercel/next.js/releases/tag/v13.5.9","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/23/3","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/23/4","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0002/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=13.0.0, <13.5.9",">=14.0.0, <14.2.25",">=15.0.0, <15.2.3",">=12.0.0, <12.3.5"],"patched":["13.5.9","14.2.25","15.2.3","12.3.5"],"from":["GHSA-f82v-jwr5-mffw"],"provenance":"source"}],"advisories":[{"id":"GHSA-f82v-jwr5-mffw","url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","severity":"CRITICAL","ecosystem":"npm","package":"next","vulnerableRanges":[">=13.0.0, <13.5.9"],"patched":["13.5.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f82v-jwr5-mffw","url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","severity":"CRITICAL","ecosystem":"npm","package":"next","vulnerableRanges":[">=14.0.0, <14.2.25"],"patched":["14.2.25"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f82v-jwr5-mffw","url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","severity":"CRITICAL","ecosystem":"npm","package":"next","vulnerableRanges":[">=15.0.0, <15.2.3"],"patched":["15.2.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f82v-jwr5-mffw","url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","severity":"CRITICAL","ecosystem":"npm","package":"next","vulnerableRanges":[">=12.0.0, <12.3.5"],"patched":["12.3.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-7243","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7243","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52124,"url":"https://www.exploit-db.com/exploits/52124","title":"Next.js Middleware 15.2.2 -  Authorization Bypass","type":"webapps","platform":"multiple","date":"2025-04-05","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-05"},"pocGithub":{"count":105,"skipped":23,"earliest":"2025-03-22","earliestUrl":"https://github.com/serhalp/test-cve-2025-29927","repos":[{"name":"aydinnyunus/CVE-2025-29927","url":"https://github.com/aydinnyunus/CVE-2025-29927","stars":101,"created":"2025-03-23"},{"name":"AnonKryptiQuz/NextSploit","url":"https://github.com/AnonKryptiQuz/NextSploit","stars":92,"created":"2025-03-28"},{"name":"websecnl/CVE-2025-29927-PoC-Exploit","url":"https://github.com/websecnl/CVE-2025-29927-PoC-Exploit","stars":20,"created":"2025-03-23"},{"name":"6mile/nextjs-CVE-2025-29927","url":"https://github.com/6mile/nextjs-CVE-2025-29927","stars":19,"created":"2025-03-23"},{"name":"azu/nextjs-cve-2025-29927-poc","url":"https://github.com/azu/nextjs-cve-2025-29927-poc","stars":15,"created":"2025-03-23"}]},"metasploit":[{"name":"Next.js Middleware Authorization Bypass Scanner","module":"auxiliary/scanner/http/nextjs_middleware_auth_bypass","type":"auxiliary","disclosureDate":"2025-03-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb"}],"nuclei":[{"id":"CVE-2025-29927","name":"Next.js Middleware Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-29927.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29927.yaml"}],"first":{"date":"2025-03-21","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-03-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-29927","provenance":"source"},{"date":"2025-03-21","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-03-22, Exploit-DB 2025-04-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb","provenance":"source"},{"date":"2025-03-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securitylabs.datadoghq.com/articles/nextjs-middleware-auth-bypass/","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 583 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 105 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-withastro-astro-cve-2025-29927","children":[{"from":"CVE-2025-29927","to":"CVE-2026-33768","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-mr6q-rp88-fx84","via":"reference","url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw"}]}],"packageHistory":[{"cve":"CVE-2024-56332","published":"2025-01-03","fixed":"15.1.2","kev":false,"link":{"from":"CVE-2024-56332","to":"CVE-2025-29927","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"13.5.8","toFixed":"13.5.9","daysApart":77}]}},{"cve":"CVE-2025-32421","published":"2025-05-14","fixed":"15.1.6","kev":false},{"cve":"CVE-2025-49826","published":"2025-07-03","fixed":"15.1.8","kev":false},{"cve":"CVE-2025-48068","published":"2025-05-30","fixed":"15.2.2","kev":false},{"cve":"CVE-2025-29927","published":"2025-03-21","fixed":"15.2.3","kev":false},{"cve":"CVE-2025-30218","published":"2025-04-02","fixed":"15.2.4","kev":false,"link":{"from":"CVE-2025-29927","to":"CVE-2025-30218","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"12.3.5","toFixed":"12.3.6","daysApart":12},{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"15.2.3","toFixed":"15.2.4","daysApart":12},{"kind":"similar","provenance":"machine","score":0.32,"basis":"same product + description similarity"}]}},{"cve":"CVE-2025-49005","published":"2025-07-03","fixed":"15.3.3","kev":false},{"cve":"CVE-2025-55173","published":"2025-08-29","fixed":"15.4.5","kev":false}],"package":"npm:next"}}