ClosedCriticalPatched

Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)

Next.js (self-hosted)

Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

Why this severity: CVSS 9.1 (GitHub advisory); trivial auth bypass

Started: Mar 21, 2025
Closed: Mar 22, 2025
CVE: CVE-2025-29927

Follow this incident

Updated Mar 22, 2025

Affected

11.1.4-12.3.4
13.0.0-13.5.8
14.0.0-14.2.24
15.0.0-15.2.2

Fixed in

12.3.5
13.5.9
14.2.25
15.2.3

Timeline2

Mar 22, 2025
Vercel publishes a postmortem on the bypass and its disclosure handling
Source
Mar 21, 2025
Next.js publishes advisory GHSA-f82v-jwr5-mffw
Source

Advisories2

News & write-ups2

Notes & caveats

Advisory published 2025-03-21 (GHSA); postmortem date approximate. Not in CISA KEV.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified