Covered by FixVibecritical

ZXCVVAKATAWASEWASEGI0. ZXCVVAKATAKILA 0ZXCV: Na Veivakadonui ni Veivakadonui ni Middleware ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE1 Na veivakadonui ni veivakadonui ni veivakadonui ni veivakadonui ni veivakadonui ena x-veivakadonui ni veivakadonui ni ulutaga ni veivakaisini. E tara na vakadewa 11.x ki na 15.x. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE2. E dua na malumalumu bibi ena CVE-2025-29927 e rawa kina vei ira na dauvakacaca me ra vakawalena na jeke ni veivakadonui e vakayacori ena middleware. Ena kena spoofing na ulutaga ni loma, na kerekere e taudaku e rawa ni masquerade me vaka na kerekere lalai vakadonui, ka vakavuna na sega ni vakadonui ni curu ki na sala taqomaki kei na itukutuku. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE3. ## Veivakaleqai ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE4. E dua na dauvakacaca e rawa ni bypass na logic ni veitaqomaki kei na veivakadonui ni jeke ena ZXCVFIXVIBETOKEN2ZXCV na kerekere, rawa ni rawata taucoko na rawa-ka ki na ivurevure vakatabui CVE-2025-29927. Na malumalumu oqo e vakatokai me bibi sara ena dua na sikoa ni CVSS ni 9.1 baleta ni sega ni gadrevi kina na dodonu ka rawa ni vakayagataki ena rede ka sega na veimaliwai ni vakayagataki Next.js. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEGA5. ## Vuna ZXCVVAKATAWASEWASEI ZXCVVAKAVUVULI6. Na malumalumu e vu mai na sala e vakayacora kina na kerekere lalai ni loma ni kena ituvatuva ni middleware. Na kerekere e vakararavi ki na middleware me baleta na veivakadonui (ZXCVFIXVIBETOKEN4ZXCV) e rawarawa kevaka era sega ni vakadeitaka vakavinaka na itekitekivu ni ulutaga ni loma ZXCVFIXVIBETOKEN2ZXCV. Vakabibi, e dua na dauvakacaca mai taudaku e rawa ni okati kina na ulutaga ni CVE-2025-29927 ena nodra kerekere me ra vakacalai na ituvatuva ki na kena qaravi na kerekere me vaka e dua na cakacaka ni loma sa vakadonui tu, vakavinaka sara na skipping ni middleware ni veitaqomaki ni vakasama ZXCVFIXVIBETOKEN3ZX. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE77. ## Na sala e vakatovolei kina ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEG8. Sa okati kina oqo me vaka e dua na jeke ni cakacaka gated. Ni oti na veivakadeitaki ni vanua ni, CVE-2025-29927 vakasaqara na ZXCVFIXVIBETOKEN3ZXCV itinitini ni ZXCVFIXVIBETOKEN3ZXCV ka cakitaka e dua na kerekere ni yavu, qai cicivaka e dua na vakadidike ni lewa lailai me baleta na ituvaki ni bypass ni middleware. E ripotetaka ga na gauna e veisau kina na sala taqomaki mai na cakitaki me rawati ena dua na sala e salavata kei na Next.js, kei na vakavinakataki ni totolo e maroroya na veivakadodonutaki vakatabakidua ena kena vakatorocaketaki na ZXCVFIXVIBETOKEN4ZXCV kei na kena tarovi na ulutaga ni middleware ni loma ena bati me yacova ni sa vakadodonutaki. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE9. ## Vakavinakataki ni simede ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI10 * Vakatorocaketaka na ZXCV: Vakavoutaka sara na nomu kerekere ki na dua na vakadewa ni patched: 12.3.5, 13.5.9, 14.2.25, se 15.2.3 [S1, S2]. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI11 * Vakatovotovotaki ni ulutaga ni ivoladusidusi: Kevaka e sega ni rawa e dua na vakatorocaketaki totolo, vakarautaka na nomu itukutuku ni ivolakerekere ni bukawaqa (WAF) se vakasuka na mata me kauta laivi na ulutaga ni CVE-2025-29927 mai na kerekere kece e tautuba e curu mai ni bera ni ra yaco ki na CVE-2025-29927ZZ. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI12 * Next.js Vakayagataki : Na vakayagataki ni vakayagataki ena ZXCVFIXVIBETOKEN2ZXCV era sa taqomaki vakavinaka mai na ituvatuva ni bukawaqa CVE-2025-29927.

A critical vulnerability in Next.js allows attackers to bypass authorization checks implemented in middleware. By spoofing internal headers, external requests can masquerade as authorized sub-requests, leading to unauthorized access to protected routes and data.

CVE-2025-29927GHSA-F82V-JWR5-MFFWCWE-863CWE-285

Impact

An attacker can bypass security logic and authorization checks in Next.js applications, potentially gaining full access to restricted resources [S1]. This vulnerability is classified as critical with a CVSS score of 9.1 because it requires no privileges and can be exploited over the network without user interaction [S2].

Root Cause

The vulnerability stems from how Next.js processes internal sub-requests within its middleware architecture [S1]. Applications that rely on middleware for authorization (CWE-863) are susceptible if they do not properly validate the origin of internal headers [S2]. Specifically, an external attacker can include the x-middleware-subrequest header in their request to trick the framework into treating the request as an already-authorized internal operation, effectively skipping the middleware's security logic [S1].

How FixVibe tests for it

FixVibe now includes this as a gated active check. After domain verification, active.nextjs.middleware-bypass-cve-2025-29927 looks for Next.js endpoints that deny a baseline request, then runs a narrow control probe for the middleware bypass condition. It reports only when the protected route changes from denied to accessible in a way consistent with CVE-2025-29927, and the fix prompt keeps remediation focused on upgrading Next.js and blocking the internal middleware header at the edge until patched.

Concrete Fixes

Upgrade Next.js: Immediately update your application to a patched version: 12.3.5, 13.5.9, 14.2.25, or 15.2.3 [S1, S2].
Manual Header Filtering: If an immediate upgrade is not possible, configure your Web Application Firewall (WAF) or reverse proxy to strip the x-middleware-subrequest header from all incoming external requests before they reach the Next.js server [S1].
Vercel Deployment: Deployments hosted on Vercel are proactively protected by the platform's firewall [S2].