CVE-2025-29927 is a critical-severity (CVSS 9.1) CWE-285 vulnerability in next. 21 public exploit references exist, so weaponization risk is real. A fix is available for next — see the affected versions and patch details below.
Authorization Bypass in Next.js Middleware
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-29927.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2025-29927 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
nextnpmDescription
Impact
It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.
Patches
- For Next.js 15.x, this issue is fixed in
15.2.3 - For Next.js 14.x, this issue is fixed in
14.2.25 - For Next.js 13.x, this issue is fixed in 13.5.9
- For Next.js 12.x, this issue is fixed in 12.3.5
- For Next.js 11.x, consult the below workaround.
Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.
Workaround
If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.
Credits
- Allam Rachid (zhero;)
- Allam Yasser (inzo_)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | next | ≥ 13.0.0&&< 13.5.9 | 13.5.9npm install next@13.5.9 |
| 📦npm | next | ≥ 14.0.0&&< 14.2.25 | 14.2.25npm install next@14.2.25 |
| 📦npm | next | ≥ 15.0.0&&< 15.2.3 | 15.2.3npm install next@15.2.3 |
| 📦npm | next | ≥ 12.0.0&&< 12.3.5 | 12.3.5npm install next@12.3.5 |
Affected Products
next.jsvercelResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Next.js Middleware 15.2.2 - Authorization Bypass
by kOaDT · Apr 5, 2025
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for next, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update next to 13.5.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-29927 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
How to detect CVE-2025-29927
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2025-29927 -u https://target- Template
- Next.js Middleware Bypass
- Severity
- critical
- Impact
- Unauthenticated attackers can bypass middleware security controls when the baseline request proves middleware enforcement and the bypass response exposes protected content.
- Remediation
- Upgrade to Next.js 14.2.25 or 15.2.3 or later. Block the x-middleware-subrequest header at the edge.
Template by ProjectDiscovery nuclei-templates (pdresearch, pdteam, hazedic), MIT licensed. View the full template. Scan only systems you are authorised to test.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is rated as Critical impact, rather than Important, because it allows complete authorization bypass in affected Next.js versions. Attackers can circumvent middleware-based authentication and access protected routes simply by including a specific HTTP header (x-middleware-subrequest). This bypasses…
Block or drop external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.Source: Red Hat security advisory for CVE-2025-29927 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2025-29927 in your dependencies?
Find it across npm, including transitive dependencies.