FixVibe

critical

CVE-2025-29927: Next.js Middleware Authorization Bypass

A critical vulnerability in Next.js allows attackers to bypass authorization checks implemented in middleware. By spoofing internal headers, external requests can masquerade as authorized sub-requests, leading to unauthorized access to protected routes and data.

CVE-2025-29927GHSA-F82V-JWR5-MFFWCWE-863CWE-285

Impact

An attacker can bypass security logic and authorization checks in Next.js applications, potentially gaining full access to restricted resources [S1]. This vulnerability is classified as critical with a CVSS score of 9.1 because it requires no privileges and can be exploited over the network without user interaction [S2].

Root Cause

The vulnerability stems from how Next.js processes internal sub-requests within its middleware architecture [S1]. Applications that rely on middleware for authorization (CWE-863) are susceptible if they do not properly validate the origin of internal headers [S2]. Specifically, an external attacker can include the x-middleware-subrequest header in their request to trick the framework into treating the request as an already-authorized internal operation, effectively skipping the middleware's security logic [S1].

How FixVibe tests for it

FixVibe's verified active scans flag Next.js routes on your domain where middleware authorization can be bypassed through CVE-2025-29927, and the fix guidance focuses on upgrading Next.js and blocking the internal middleware header at the edge until you patch.

Concrete Fixes

  • Upgrade Next.js: Immediately update your application to a patched version: 12.3.5, 13.5.9, 14.2.25, or 15.2.3 [S1, S2].
  • Manual Header Filtering: If an immediate upgrade is not possible, configure your Web Application Firewall (WAF) or reverse proxy to strip the x-middleware-subrequest header from all incoming external requests before they reach the Next.js server [S1].
  • Vercel Deployment: Deployments hosted on Vercel are proactively protected by the platform's firewall [S2].