CVE-2025-29927: Next.js Middleware Authorization Bypass

CVE-2025-29927 identifies a critical authorization bypass vulnerability in the Next.js framework. The flaw allows attackers to circumvent access control mechanisms implemented in Next.js middleware by exploiting the x-middleware-subrequest HTTP header. This direct impact on authentication and authorization components makes the vulnerability particularly severe for organizations running Next.js-based full-stack web applications and systems requiring robust access controls.

The CVSS score is 9.1, classified as critical, indicating immediate and widespread risk. The vulnerability was published by NVD on March 21, 2025, and affects versions from 1.11.4 up to versions prior to 12.3.5, 13.5.9, 14.2.25, and 15.2.3. Evidence indicates that a proof of concept is publicly available, raising the risk of active exploitation. Official patches are available in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

For defenders: the top priority is to update Next.js to patched versions (12.3.5+, 13.5.9+, 14.2.25+, 15.2.3+) immediately. If immediate patching is not feasible, filter inbound external requests containing the x-middleware-subrequest header at your network edge to prevent bypass. Test all patches in staging before production rollout, and monitor application logs for exploitation indicators (anomalous requests carrying that header).