Impact
An attacker can bypass security logic and authorization checks in Next.js applications, potentially gaining full access to restricted resources [S1]. This vulnerability is classified as critical with a CVSS score of 9.1 because it requires no privileges and can be exploited over the network without user interaction [S2].
Root Cause
The vulnerability stems from how Next.js processes internal sub-requests within its middleware architecture [S1]. Applications that rely on middleware for authorization (CWE-863) are susceptible if they do not properly validate the origin of internal headers [S2]. Specifically, an external attacker can include the x-middleware-subrequest header in their request to trick the framework into treating the request as an already-authorized internal operation, effectively skipping the middleware's security logic [S1].
How FixVibe tests for it
FixVibe now includes this as a gated active check. After domain verification, active.nextjs.middleware-bypass-cve-2025-29927 looks for Next.js endpoints that deny a baseline request, then runs a narrow control probe for the middleware bypass condition. It reports only when the protected route changes from denied to accessible in a way consistent with CVE-2025-29927, and the fix prompt keeps remediation focused on upgrading Next.js and blocking the internal middleware header at the edge until patched.
Concrete Fixes
- Upgrade Next.js: Immediately update your application to a patched version: 12.3.5, 13.5.9, 14.2.25, or 15.2.3 [S1, S2].
- Manual Header Filtering: If an immediate upgrade is not possible, configure your Web Application Firewall (WAF) or reverse proxy to strip the
x-middleware-subrequestheader from all incoming external requests before they reach the Next.js server [S1]. - Vercel Deployment: Deployments hosted on Vercel are proactively protected by the platform's firewall [S2].