Next.js: a middleware bypass flaw (CVE-2025-29927) is made public

2025-03-21 · Publisher : Vercel · Domain : Cloud & DevOps

On 21 March 2025, flaw CVE-2025-29927 is disclosed: an internal header allowed bypassing Next.js middleware, often used for authentication. Self-hosted applications were affected.

### Background On 21 March 2025 at 10:17 GMT, flaw **CVE-2025-29927** (GHSA-f82v-jwr5-mffw) was made public. Next.js uses an internal header, `x-middleware-subrequest`, to detect and prevent recursion between middlewares. An attacker adding it to a request could skip middleware execution, and therefore the security checks placed there. Vercel published its post-mortem on 25 March. ### Key facts - Timeline: reported on 27 February 2025, investigation from 5 March, flaw confirmed on 14 March, patches released on 17 and 18 March (versions 14.2.25 and 15.2.3), disclosure on 21 March. - Affected versions: Next.js 12.x to 15.x, for self-hosted deployments (`next start` and `output: 'standalone'`). - Not affected: applications hosted on Vercel, static exports, and deployments on Netlify and Cloudflare Workers. - Vercel acknowledges initial triage delays, as reports arrived through several channels. ### Why it matters Middleware often runs at the edge and serves as a single point of authentication or redirection. The flaw shows the danger of relying only on this layer to protect data. For teams self-hosting Next.js, the lesson is twofold: update quickly, and double access controls at the route and data level, not only in middleware. ### Takeaway A security check placed only in middleware did not withstand a simple HTTP header.

Tags : Sécurité, Edge, Serverless, Open Source