Log in Start free

Vulnerability · Published Mar 21, 2025 · Assigned by GitHub_M

CVE-2025-29927Authorization Bypass in Next.js Middleware

Critical 9.1

In plain English

A critical-severity security flaw in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 99.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)99.2%top 0.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling3Metasploit, Nuclei, Public PoC

Official description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnext13.5.9GHSA-f82v-jwr5-mffw
npmnext14.2.25GHSA-f82v-jwr5-mffw
npmnext15.2.3GHSA-f82v-jwr5-mffw
npmnext12.3.5GHSA-f82v-jwr5-mffw

Affected products (as reported)

VendorProductVersions
vercel next.js >= 11.1.4, < 12.3.5>= 14.0.0, < 14.2.25>= 15.0.0, < 15.2.3>= 13.0.0, < 13.5.9

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References