CVE-2025-29927

Published Mar 21, 2025

Last updated a month ago

CVSS critical 9.1
React
Next.js

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-29927 is an authorization bypass vulnerability affecting Next.js, a React framework. It stems from the improper handling of the `x-middleware-subrequest` header. By exploiting this vulnerability, attackers can bypass authorization checks implemented in Next.js middleware. This flaw allows attackers to skip running the middleware, potentially allowing requests to bypass critical checks like authorization cookie validation before reaching routes. Self-hosted Next.js applications using Middleware are affected, specifically those relying on it for authentication or security checks. The vulnerability is fixed in Next.js versions 14.2.25 and 15.2.3.

Description
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Source
security-advisories@github.com
NVD status
Awaiting Analysis

Insights

Analysis from the Intruder Security Team
Published Mar 24, 2025 Updated Mar 24, 2025

This authentication bypass vulnerability in Next.js allows an attacker to bypass middleware validation steps such as checking the user is authorized to access a resource. The exploit is simple to use and could potentially be exploited en-masse, though some manual effort is likely to be required to identify routes that are not accessible without authentication.

The advisory states that deployments using next start and output: 'standalone' should be updated as a priority, and lists the affected versions.

Next.js is a full stack framework, and applications which are only using front-end elements of the framework will not be vulnerable. Additionally, popular WAFs like Cloudflare added detection rules for this exploit already, so there is also reduced risk for applications which are deployed behind a WAF with effective rules. However, WAFs should not be relied upon to protect against this weakness, as further research could reveal bypasses, or alternative routes to exploit the weakness.

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.1
Impact score
5.2
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-285

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

11

  1. 🚨 CVE-2025-29927: Next.js Middleware Authorization Bypass A critical flaw in Next.js allows attackers to spoof the x-middleware-subrequest header, bypassing middleware, including auth checks, and accessing protected routes.

    @ali_sher_shahid

    8 May 2025

    8 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  2. Impact : It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. CVE-ID : CVE-2025-29927 Weakness : CWE-285 ( Improper Authorization ) Credits : - Allam Rachid (zhero;) - Allam Yasser (inzo_) https://t.co/7Rm

    @40sp3l

    7 May 2025

    3363 Impressions

    10 Retweets

    134 Likes

    64 Bookmarks

    2 Replies

    0 Quotes

  3. CVE-2025-29927: Next.js Middleware Authorization Bypass https://t.co/qXHAOwHp22

    @Info2sec_Torii

    5 May 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2025-29927: #Next.js #Middleware #Authorization_Bypass https://t.co/QkyPAGAuaz https://t.co/2UXSqdnoDi

    @omvapt

    2 May 2025

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Security matters, especially when it impacts your production apps. This post breaks down CVE-2025-29927 in Next.js: what it is, what’s at risk, and what steps to take. We walk through the impact with precision, so you can act fast and stay secure: https://t.co/DR1Xw6wmHq 🔐

    @upsuncom

    2 May 2025

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Proof-of-Concept Exploit: Next.js Middleware (CVE-2025-29927) Credit: https://t.co/WEAd19KCE9 https://t.co/NxyiCLjVqR

    @DarkWebInformer

    1 May 2025

    22151 Impressions

    68 Retweets

    432 Likes

    275 Bookmarks

    3 Replies

    0 Quotes

  7. 🚨 CVE-2025-29927: Next.js Middleware Authorization Bypass A critical flaw in Next.js allows attackers to spoof the x-middleware-subrequest header, bypassing middleware, including auth checks, and accessing protected routes. 📍 CVSS: 9.1 🛡️ Impact: Auth bypass, privile

    @offsectraining

    1 May 2025

    4148 Impressions

    11 Retweets

    59 Likes

    10 Bookmarks

    1 Reply

    0 Quotes

  8. Doing the Due Diligence: Analyzing the Next.js Middleware Bypass (CVE-2025-29927) #Next.jsVulnerability #MiddlewareBypass #CVE202529927 #SecurityResearch #DueDiligence https://t.co/lKIO3lROJU

    @reverseame

    28 Apr 2025

    1590 Impressions

    6 Retweets

    26 Likes

    5 Bookmarks

    2 Replies

    0 Quotes

  9. Lessons from CVE-2025-29927 (Next.js auth bypass) When a major web framework springs a leak, what can we learn? 🤔 No One’s Invincible, Speed Matters & Defence in Depth Read our latest article here: https://t.co/W9dpluv4pT #AppSec #VulnerabilityManagement #ApolloSec

    @ApolloSec110629

    26 Apr 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Threat Alert: Ghost-Route - Ghost Route Detects If A Next JS Site Is Vulnerable To The Corrupt CVE-2025-29927 Severity: ⚠️ Critical Maturity: 💥 Mainstream Learn more: https://t.co/IY5h7vrAEU #CyberSecurity #ThreatIntel #InfoSec (1/3)

    @fletch_ai

    23 Apr 2025

    55 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  11. Hey, did you hear about the Next.js flaw (CVE-2025-29927)? Attackers can sneak in using a fake "x-middleware-subrequest" header! Like a wolf in sheep's clothing! Patch ASAP! https://t.co/B0GSmAwGH0

    @fin_tech_news_

    22 Apr 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. Ready to tackle another legendary CVE? 🔍 Just added to Hackviser Labs: A hands-on lab for Next.js Middleware Authorization Bypass (CVE-2025-29927)! 🚀 Perfect for security professionals and enthusiasts looking to understand and practice with real-world vulnerabilities 💪 Try

    @hackviserr

    22 Apr 2025

    178 Impressions

    4 Retweets

    10 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. Critical vulnerability CVE-2025-29927 in Next.js allows unauthorized access via middleware. Affects versions before 12.3.5, 13.5.9, 14.2.25, and 15.2.3. Stay updated! 🚨 #NextJS #DataProtection #USA link: https://t.co/uhndwFlyYo https://t.co/legkeFgEKk

    @TweetThreatNews

    21 Apr 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 💥 FLASH NOTICE 💥 CVE-2025-29927 is a #criticalvulnerability discovered in Next.js, and allows attackers to bypass authorization checks enforced in #middleware. For full details & mitigation recommendations, view the notice here: https://t.co/CKXuyiLIlj https://t.co/2tPQH19

    @Avertium

    18 Apr 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. Next.js Middleware Auth Bypass (CVE-2025-29927) and Local File Read via XXE - HackDonalds Challenge https://t.co/z3hCTQTQw2 @intigriti

    @tbbhunter

    17 Apr 2025

    4743 Impressions

    8 Retweets

    36 Likes

    16 Bookmarks

    0 Replies

    1 Quote

  16. A critical vulnerability (CVE-2025-29927) in the Next.js framework that could expose sensitive data has been discovered. Read advise from the NCSC: https://t.co/QG1cDJkLHb Check out the NCSC advisory and take action to secure your apps. #CyberSecurity #NextJS #WebDevelopment

    @DigitalXRAID

    15 Apr 2025

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. 🚨ثغرة #CVE-2025-29927 لتجاوز مصادقة Next.js Middleware! ☑️الخطر: الوصول غير المصرح به إلى الموارد المحمية ☑️الإصدارات المهددة: 14.2.25 ومادون ☑️بحث https://t.co/gKKiwWrA0u ب : "X Powered By: Next.js" ☑️الحل: تحديث الإصدار و #ASM https://t.co/OAmmhkjFrj https://t.co/rQTTMorqJV

    @CriminalIP_AR

    15 Apr 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Next.js Middlewareの認証バイパス脆弱性「#CVE-2025-29927」 ☑️影響:保護されたリソースへの不正アクセス ☑️脆弱版:14.2.25未満 ☑️修正版:12.3.5、13.5.9、14.2.25、15.2.3 ☑️https://t.co/IVizkfqat2 のクエリ:"X Powered By: Next.js" ☑️対策:バージョンアップ & #ASM https://t.co/nOMNodXyZC https://t.co/pXo7WPGgEc

    @CriminalIP_JP

    15 Apr 2025

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. 🚨Next.js 미들웨어 인증 우회 취약점 #CVE-2025-29927! ☑️영향: 보호된 리소스에 비인가 접근 ☑️취약 버전: 14.2.25 미만 ☑️수정 버전: 12.3.5, 13.5.9, 14.2.25, 15.2.3 ☑️https://t.co/ZdemHmQb5V 탐지 쿼리: "X Powered By: Next.js" ☑️조치: 버전 업데이트 & #ASM Blog: https://t.co/NcJ1dmn6PR https://t.co/SgpUNJ7hwq

    @CriminalIP_KR

    15 Apr 2025

    79 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  20. HackerNotes TLDR for episode 118! Link for the post with all references below. ►⠀Next.js Middleware Bypass (CVE-2025-29927): The Searchlight Cyber (AssetNote) team has done another deep dive on the Next.JS middleware bypass, giving us some extra payloads to play around with.

    @ctbbpodcast

    14 Apr 2025

    2309 Impressions

    3 Retweets

    43 Likes

    17 Bookmarks

    0 Replies

    0 Quotes

  21. Read about observed attack traffic, detections, and mitigations for an authorization bypass vulnerability in Next.js (CVE-2025-29927). Learn more. @Akamai #AkamaiSecurity https://t.co/4SGK2EGtg4 https://t.co/zPEmNMGoNt

    @Yanivzadok

    13 Apr 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🚨 New Arena Lab Dropped! Middleman (CVE-2025-29927) is now live on Parrot CTFs! 💥 Learn how to exploit a middleware authentication bypass in Next.js and gain access to protected routes. 🔓 Easy difficulty – perfect for sharpening your web exploitation skills! 🏆 Earn 10 https

    @parrot_ctfs

    11 Apr 2025

    110 Impressions

    2 Retweets

    8 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. NextJS Vulnerability Alert: CVE-2025-29927 A new auth bypass bug has hit Next.js — are your apps safe? 🔐 Dive into the full breakdown: 🔗 https://t.co/c3CkACGdjb #ParrotCTFs https://t.co/iJ0iQYmGfp

    @parrot_ctfs

    10 Apr 2025

    82 Impressions

    2 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. 🚨 Next.js CVE-2025-29927 Exploit May Threaten Web3 dApps 🔴 How might the attack work? Attackers can exploit the CVE-2025-29927 vulnerability in Next.js to bypass authentication in web applications, including Web3 dApps, by forging the x-middleware-subrequest header. This https

    @cometix_ai

    9 Apr 2025

    124 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. 🚨 Next.js CVE-2025-29927 Exploit May Threaten Web3 dApps 🔴 How might the attack work? Attackers can exploit the CVE-2025-29927 vulnerability in Next.js to bypass authentication in web applications, including Web3 dApps, by forging the x-middleware-subrequest header. This https

    @cometix_ai

    9 Apr 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. #ThreatProtection #CVE-2025-29927 - Next.js middleware #vulnerability, read more about Symantec's protection: https://t.co/gmmvONPKas

    @threatintel

    9 Apr 2025

    59 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. A critical vulnerability in Next.js middleware, CVE-2025-29927, allows authentication bypass, exposing over 520K assets; users are urged to update to version 14.1.0-canary.35 or later to mitigate risks. #NextJS #CyberSecurity https://t.co/ItjCdR16X4

    @Cyber_O51NT

    9 Apr 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. Next.js Middleware Bypass Vulnerability CVE-2025-29927 https://t.co/9m72dQGEcW 🧵 https://t.co/6frReWA2xy

    @keraattin

    8 Apr 2025

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  29. Read about observed attack traffic, detections, and mitigations for an authorization bypass vulnerability in Next.js (CVE-2025-29927). Learn more. @Akamai #AkamaiSecurity https://t.co/4xkzph74BL https://t.co/lb1VWilwL7

    @epichol

    7 Apr 2025

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    6 Apr 2025

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  31. 🌀 This is wild! ⚡ You’ve probably seen Next.js middleware auth bypass (CVE-2025-29927) — but there’s another similar vulnerability: CVE-2024-51479 POC: curl "https://t.co/WC2hLrIlnB" -i fixed: Next.js v14.2.15 For more read: https://t.co/7EaQRFIfJa #Nextjs #bugbountytips #CVE

    @darkshadow2bd

    6 Apr 2025

    240 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  32. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    6 Apr 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  33. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    5 Apr 2025

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  34. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    4 Apr 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  35. Next.js alert: a critical middleware bypass (CVE-2025-29927) could put your app at risk. Update your version to secure your site. #CodeNewbie https://t.co/qDetrKavqd

    @CodeNewbies

    4 Apr 2025

    553 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. CVE-2025-29927: this is a vulnerability associated with Nextjs it allows attackers to bypass middleware..to check whether your next application is affected,run this command on an Linux cmd: nuclei -u <your website url> -t http/cves/2025/CVE-2025-29927.yaml -vv

    @prakash_dev11

    4 Apr 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    4 Apr 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  38. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    3 Apr 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  39. Next.js had a serious middleware bypass bug (CVE-2025-29927). Attackers could skip auth and other logic just by spoofing a header. Broke it down simply, what happened, how it was fixed, and what to do now: https://t.co/bVhDybLmvH #Nextjs #webdev #infosec

    @Jagadhis02

    3 Apr 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. 🚨 Next.js Alert (CVE-2025-29927) 🚨 Risk: Middleware bypass allows unauthorized access. Affected: 12.x <12.3.5, 13.x <13.5.9, 14.x <14.2.25, 15.x <15.2.3. Fix: Update, secure middleware, check logs. Patch now! 🚀 #Nextjs #CyberSecurity #SecurityUpdate #DevCommunity h

    @HafizAliAhmed9

    3 Apr 2025

    42 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  41. I recently reported a vulnerability to Next.js, which is a partial bypass of the middleware authentication bypass vulnerability (CVE-2025-29927) with Takumi (https://t.co/vV7HCbs9Dr), an AI security engineer.

    @ryotkak

    3 Apr 2025

    4251 Impressions

    12 Retweets

    81 Likes

    21 Bookmarks

    1 Reply

    0 Quotes

  42. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    2 Apr 2025

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  43. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    2 Apr 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. Plop, HExHTTP v1.8: - New cve module to check Next.js CPDoS by @zhero___ research (CVE-2025-29927) - New module to check cache poisoning via path traversal (Thanks @0xRTH !) - Proxy features (-p option) https://t.co/rKm7WZzeBS HF !

    @c0dejump

    2 Apr 2025

    211 Impressions

    0 Retweets

    11 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  45. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    2 Apr 2025

    27 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  46. NextJs security update: CVE-2025-29927 https://t.co/geegiCsN1c

    @HaamedBahram

    1 Apr 2025

    11651 Impressions

    0 Retweets

    6 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  47. Actively exploited CVE : CVE-2025-29927

    @transilienceai

    1 Apr 2025

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  48. I Scanned 100,000+ Subdomains For CVE-2025-29927 https://t.co/jsGw3AjA8t @NahamSec

    @tbbhunter

    1 Apr 2025

    1615 Impressions

    0 Retweets

    19 Likes

    4 Bookmarks

    0 Replies

    0 Quotes

  49. Uncovered a critical vulnerability (CVE-2025-29927) affecting countless apps after scanning 100,000+ subdomains. Even major companies with hefty security budgets remain exposed. 🔍💻 #VulnerabilityScan #SubFinder #USA link: https://t.co/vqvUz90GTU https://t.co/Uer73iiF32

    @TweetThreatNews

    31 Mar 2025

    72 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. Authorisation bypass vulnerability in Next.js web development framework (CVE-2025-29927) #AuthorizationBypassVulnerability #CVE202529927 #nextjs https://t.co/BMehYmuns4 https://t.co/KyuvLc6PvO

    @SystemTek_UK

    31 Mar 2025

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes