Mar 22, 2025

Updated

• ClosedCritical✓Patched

  Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)

  Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

  Next.js (self-hosted)·Closed Mar 22, 2025·updated Mar 22, 2025