CVE-2025-29927

Published Mar 21, 2025

Last updated 7 months ago

CVSS critical 9.1

React

Next.js

Overview

Description: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Source: security-advisories@github.com
NVD status: Analyzed
Products: next.js

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-285
nvd@nist.gov: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "6D275D05-70E5-49CA-BCFE-74B31DB3D8EF",
            "versionEndExcluding": "12.3.5",
            "versionStartIncluding": "11.1.4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "49731FD6-617A-42DE-9F95-A7F42809C32F",
            "versionEndExcluding": "13.5.9",
            "versionStartIncluding": "13.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "5F836D0E-1580-40C6-93E5-6DB939E7BA86",
            "versionEndExcluding": "14.2.25",
            "versionStartIncluding": "14.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "E214D84F-7B55-4089-B1C4-9BF8B7AC7375",
            "versionEndExcluding": "15.2.3",
            "versionStartIncluding": "15.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References