What Happened

CVE-2025-29927 (CVSS 9.1) is a critical authorization bypass in the Next.js framework. By sending the HTTP header x-middleware-subrequest: middleware (set to the path of the middleware module), an attacker can cause the Next.js server to skip middleware execution for that request.

Who Is Affected

  • Next.js >= 11.1.4 and < 14.2.25 (self-hosted)
  • Next.js >= 15.0.0 and < 15.2.3 (self-hosted)
  • Vercel-hosted applications are NOT affected — Vercel strips this header at the edge

Attack Scenario

# Bypass authentication middleware

curl -H 'x-middleware-subrequest: src/middleware' \


  https://example.com/admin/dashboard



Returns 200 with admin content instead of 401

Any route protected only by middleware (e.g., JWT validation, IP allowlisting, geo-blocking, A/B test routing) is completely bypassed.

Recommended Actions

  1. Upgrade to Next.js 14.2.25 or 15.2.3
  2. If unable to upgrade immediately, configure your reverse proxy (nginx/Caddy/CloudFront) to strip x-middleware-subrequest headers from incoming requests
  3. Audit your middleware — ensure critical auth logic also exists in API route handlers (defense in depth)
  4. Never rely solely on middleware for access control to sensitive routes