BaseFortify

Publication date: 2025-03-21

Last updated on: 2025-09-10

Assigner: GitHub, Inc.

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-03-21

Last Modified

2025-09-10

Generated

2026-09-27

AI Q&A

2025-03-24

EPSS Evaluated

2026-09-26

NVD

CVE-2025-29927

Affected Vendors & Products

Vendor	Product	Version / Range
vercel	next.js	From 11.1.4 (inc) to 12.3.5 (exc)
vercel	next.js	From 13.0.0 (inc) to 13.5.9 (exc)
vercel	next.js	From 14.0.0 (inc) to 14.2.25 (exc)
vercel	next.js	From 15.0.0 (inc) to 15.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2025-29927 is a critical vulnerability identified in Next.js middleware that allows for authorization bypass in applications. It affects versions greater than 11.1.4 and less than or equal to 13.5.6, as well as versions greater than 14.0 and less than 14.2.25, and versions greater than 15.0 and less than 15.2.3. The vulnerability allows unauthorized access if the authorization check is implemented in middleware. It is resolved in Next.js 15.2.3 and 14.2.25. [1, 2, 3]

Impact Analysis

The vulnerability can lead to unauthorized access to applications if critical checks, such as authorization cookie validation, are bypassed due to improper handling of the internal header 'x-middleware-subrequest'. This is particularly concerning for self-hosted applications using Middleware for authentication or security checks. [1, 2]

Mitigation Strategies

If patching to a safe version is infeasible, it is recommended to block external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. [1, 2]

Hi! I’m here to help you understand CVE-2025-29927. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70