{"id":"CVE-2025-29927","title":"Next.js middleware authorization bypass via x-middleware-subrequest","summary":"A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-285","vendor":"Next.js","product":"Next.js","platforms":["Node.js","Web"],"affected":[">=11.1.4 <12.3.5",">=13.0.0 <13.5.9",">=14.0.0 <14.2.25",">=15.0.0 <15.2.3"],"patched":["14.2.25","15.2.3"],"exploited":false,"zeroDay":false,"epss":0.99225,"epssPercentile":0.99935,"source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","references":[{"url":"https://github.com/advisories/GHSA-f82v-jwr5-mffw","label":"GitHub Advisory"},{"url":"https://nextjs.org/blog/cve-2025-29927","label":"Next.js advisory"}],"tags":["nextjs","authz-bypass","web","middleware","exploit-available"],"ecosystem":"Vercel","exploitAvailable":true,"exploits":{"exploitdb":true,"github":123,"githubRepos":["https://github.com/serhalp/test-cve-2025-29927","https://github.com/Ademking/CVE-2025-29927","https://github.com/6mile/nextjs-CVE-2025-29927"],"metasploit":["auxiliary/scanner/http/nextjs_middleware_auth_bypass"],"nuclei":["CVE-2025-29927"],"checkedAt":"2026-09-23T07:13:13.801Z"},"slug":"CVE-2025-29927","body":"## Overview\n\nNext.js uses an internal `x-middleware-subrequest` header to prevent infinite\nmiddleware recursion. The check could be satisfied by an attacker-supplied value,\ncausing the framework to **skip middleware execution** for the request.\n\nAny security control implemented in `middleware.ts` — auth gates, redirects, header\ninjection, geo/path restrictions — can be bypassed by sending the header directly.\n\n## Impact\n\n- Bypass of authentication/authorization enforced in middleware.\n- Access to protected routes/pages without valid session.\n- Affects self-hosted deployments using `next start` / standalone output. Sites on\n  Vercel and Netlify were mitigated at the platform edge.\n\n## Proof of concept\n\n```http\nGET /admin HTTP/1.1\nHost: target.example\nx-middleware-subrequest: middleware:middleware:middleware:middleware:middleware\n```\n\nIf `/admin` is gated only by middleware, the request reaches the route handler\nwithout the middleware ever running.\n\n## Remediation\n\n1. Upgrade to **15.2.3**, **14.2.25**, **13.5.9**, or **12.3.5**.\n2. If you cannot upgrade immediately, strip the `x-middleware-subrequest` header at\n   your reverse proxy/WAF for all external requests.\n3. Defense in depth: enforce authorization in the data/route layer, not middleware\n   alone.\n\n## References\n\n- GitHub Advisory: <https://github.com/advisories/GHSA-f82v-jwr5-mffw>\n- Next.js advisory: <https://nextjs.org/blog/cve-2025-29927>","depth":"abyssal","depthScore":82,"depthScoreParts":{"impact":50.1,"likelihood":19.8,"exploitation":12,"ransomware":0},"changes":[]}