# Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927) · pwn.watch

> Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

Page: https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Next.js (self-hosted)
- Started: 2025-03-21 · closed: 2025-03-22
- CVEs: CVE-2025-29927
- Affected: 11.1.4-12.3.4; 13.0.0-13.5.8; 14.0.0-14.2.24; 15.0.0-15.2.2
- Fixed in: 12.3.5; 13.5.9; 14.2.25; 15.2.3

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927/feed.xml
- JSON Feed: https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927.json
- This file: https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927/llms.txt

## Updates (newest first)
- 2025-03-22: Vercel publishes a postmortem on the bypass and its disclosure handling (https://vercel.com/blog/postmortem-on-next-js-middleware-bypass)
- 2025-03-21: Next.js publishes advisory GHSA-f82v-jwr5-mffw (https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)

## Fix brief
# Security brief: Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)

Source: https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 · status: closed (closed Mar 22, 2025) · severity: critical · updated Mar 22, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

Severity detail: CVSS 9.1 (GitHub advisory); trivial auth bypass

- Product: Next.js (self-hosted)
- CVE / advisory ids: CVE-2025-29927

## Affected versions
- 11.1.4-12.3.4
- 13.0.0-13.5.8
- 14.0.0-14.2.24
- 15.0.0-15.2.2

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 12.3.5
- 13.5.9
- 14.2.25
- 15.2.3

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Mar 22, 2025: Vercel publishes a postmortem on the bypass and its disclosure handling
- Mar 21, 2025: Next.js publishes advisory GHSA-f82v-jwr5-mffw

## Advisories
- [Authorization Bypass in Next.js Middleware (GHSA-f82v-jwr5-mffw)](https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw) (Vercel / GitHub)
- [NVD: CVE-2025-29927](https://nvd.nist.gov/vuln/detail/CVE-2025-29927) (NVD)

## Write-ups & news
- [Postmortem on Next.js Middleware bypass](https://vercel.com/blog/postmortem-on-next-js-middleware-bypass)
- [Next.js and the corrupt middleware: the authorizing artifact](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware)

## Caveats
Advisory published 2025-03-21 (GHSA); postmortem date approximate. Not in CISA KEV.

---
Machine-readable: https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.