CVE-2025-29927

Vercel · Published March 21, 2025

9.1

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Next.js middleware authorization bypass. Sending a request with x-middleware-subrequest header set to the middleware's module path allows attackers to skip middleware execution entirely, bypassing authentication and authorization controls.

Affected Products

Next.js >= 11.1.4 and < 14.2.25
Next.js >= 15.0.0 and < 15.2.3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Related Advisories

CVECRITICALCVE-2025-29927

Next.js Middleware Auth Bypass (CVE-2025-29927) — Patch Your Web Apps Now

A trivial header injection in Next.js allows attackers to skip middleware execution entirely, bypassing authentication, authorization, and security checks on any route protected only by Next.js middleware.

WHY IT MATTERS

Any Next.js app using middleware as the sole auth gate for a route is currently bypassable with a single header — patch to 14.2.25 or 15.2.3 immediately.

Remote Code ExecutionT1190 Exploit Public-Facing App

Mar 21, 2025· 3 min read