CVE-2025-29927

Name of the Vulnerable Software and Affected Versions Next.js versions 1.11.4 through 12.3.4 Next.js versions 13.0.0 through 13.5.8 Next.js versions 14.0.0 through 14.2.24 Next.js versions 15.0.0 through 15.2.2

Description An authorization bypass exists in the Next.js middleware processing mechanism. By sending a specially crafted HTTP request containing the x-middleware-subrequest header, a remote attacker can trick the application into treating the request as if it has already passed through the middleware checks. This allows the attacker to bypass authentication enforcement, session validation, rate-limiting, and path rewrites. Additionally, this flaw can be used to bypass Content-Security-Policy (CSP) headers or trigger a Denial-of-Service (DoS) via cache poisoning. Real-world exploitation has been observed by threat actors, including the TeamPCP group, who target admin panels and API routes gated by session tokens. Next.js deployments hosted on Vercel are automatically protected.

Recommendations Update Next.js to version 12.3.5 or later. Update Next.js to version 13.5.9 or later. Update Next.js to version 14.2.25 or later. Update Next.js to version 15.2.3 or later. As a temporary workaround, prevent external user requests containing the x-middleware-subrequest header from reaching the application. Implement authorization checks at the route level in addition to middleware to provide defense-in-depth.