Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927) ยท updates https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge. en Sat, 22 Mar 2025 00:00:00 GMT Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927): Vercel publishes a postmortem on the bypass and its disclosure handling https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927#2025-03-22-4b09f069 Sat, 22 Mar 2025 00:00:00 GMT critical <p><a href="https://vercel.com/blog/postmortem-on-next-js-middleware-bypass">Source</a></p> Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927): Next.js publishes advisory GHSA-f82v-jwr5-mffw https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927#2025-03-21-fce69380 Fri, 21 Mar 2025 00:00:00 GMT critical <p><a href="https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw">Source</a></p>