Skip to content
HACKTECH
Web & CMSReported Published 4 sources

Next.js middleware flaw CVE-2025-29927 let a crafted header skip authorisation checks

On 21 March 2025 the Next.js maintainers published advisory GHSA-f82v-jwr5-mffw for CVE-2025-29927, a critical (CVSS 9.1) flaw that let a request carrying the internal x-middleware-subrequest header skip middleware, and with it any authorisation checks performed there. According to Vercel's postmortem, self-hosted applications using next start with output: 'standalone' were affected, while apps on Vercel, Netlify or Cloudflare Workers and static exports were not. Fixes shipped in 12.3.5, 13.5.9, 14.2.25 and 15.2.3, and Datadog Security Labs later reported low-volume scanning that used known exploit header values.

  • Next.js
  • CVE-2025-29927
  • authorisation bypass
  • middleware
  • Vercel
  • JavaScript

What the sources report

  • GitHub advisory GHSA-f82v-jwr5-mffw rates CVE-2025-29927 critical with CVSS 9.1 (CWE-285, Improper Authorization); affected ranges start at 11.1.4 and the patched releases are 12.3.5, 13.5.9, 14.2.25 and 15.2.3.
  • Next.js skipped middleware when x-middleware-subrequest contained the middleware path, for example middleware or src/middleware; on 15.x the value had to repeat it to reach the recursion limit of 5, as in middleware:middleware:middleware:middleware:middleware (Fastly, Datadog).
  • Vercel's postmortem says the issue was reported on 27 February 2025, confirmed by the Next.js team on 14 March, patched in 14.2.25 and 15.2.3 on 17 and 18 March, made public on 21 March, and backported to 13.5.9 and 12.3.5 on 22 and 23 March.
  • According to Vercel, deployments on Vercel, Netlify and Cloudflare Workers were not affected because their routing runs in a separate, decoupled system; self-hosted apps using next start with output: 'standalone' were affected, and static exports were ruled out.
  • Fastly notes the researchers who reported the flaw also showed it could cause denial of service through cache poisoning.
  • Datadog Security Labs (28 March 2025) described observed scanning as generally small in volume, ineffective and poorly targeted, and listed 33 IP addresses it had high confidence in, each seen in at least five distinct environments.

What it means for your organisation

Any self-hosted Next.js app that enforced access control only in middleware could be reached by adding one request header, so real exposure depended on architecture as much as on version. Authorisation should be re-checked where data is read and changed, and edge proxies should strip framework-internal headers from external traffic.

What we check

  • Inventory Next.js versions on every self-hosted service and confirm 12.3.5, 13.5.9, 14.2.25, 15.2.3 or later.
  • Send requests carrying x-middleware-subrequest values such as middleware, src/middleware, pages/_middleware and the five-fold repeated form to protected routes and confirm access is still denied.
  • Confirm the CDN, load balancer or reverse proxy strips x-middleware-subrequest from external requests.
  • Review whether route handlers, server actions and API endpoints re-check authorisation instead of relying on middleware alone.
  • Search access logs for inbound requests containing the x-middleware-subrequest header.

Sources

Services that cover these checks

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Website security audit

    A review of a public website's TLS and security headers, third-party scripts, CMS and plugin versions, forms, authentication and hosting configuration. Every check is marked pass, fail or not applicable with the evidence attached, so the result doubles as a compliance artefact.

    Duration: 3 to 6 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works