vercel · next.js
A flaw in the middleware of Next.js, the React framework for full-stack web applications, allows authorization checks performed in middleware to be bypassed. An unauthenticated remote attacker over the network can exploit it without any user interaction or special configuration, simply by sending requests containing the x-middleware-subrequest header.
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
First seen exploited 7 days after disclosure. Public exploit code (Metasploit) was available the same day.
3 related vulnerabilities in the same code over 17 months. The latest fix listed for next is 15.4.5.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: next.
Upgrade to 15.2.3 or later
npm install next@15.2.3The first fix for CVE-2025-29927.
| If you run | Upgrade to |
|---|---|
| 15.0.0 up to 15.2.3 | 15.2.3 |
| 14.0.0 up to 14.2.25 | 14.2.25 |
| 13.0.0 up to 13.5.9 | 13.5.9 |
| 12.0.0 up to 12.3.5 | 12.3.5 |
“Up to” means the second version is the fix and is not affected.