CVE-2025-29927Critical· 9.1▾ AbyssalPoC available

Next.js middleware authorization bypass via x-middleware-subrequest

A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score82/ 100 · Severe

impact 50.1 · likelihood 19.8 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

—

Updated

—

CVSS

9.1

Vendor

Next.js

Product

Next.js

CWE

CWE-285

Depth score

82 · Severe

EPSS

99% · p100

Platforms

Node.js, Web

Source

GHSA

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploit availability

Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.

checked 2026-09-21

Exploit-DB

Search Exploit-DB for CVE-2025-29927 ↗

GitHub PoCs

123 public repositories

Metasploit

auxiliary/scanner/http/nextjs_middleware_auth_bypass ↗

Nuclei

CVE-2025-29927.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 9.

99% → 99%▼ 0.08%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 75 days

Jul 9, 2026EPSS first tracked
99%
Sep 21, 2026Public exploit observed
Exploit-DB · 123 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)

Next.js CWE-285 #nextjs #authz-bypass #web #middleware #exploit-available

Affected

>=11.1.4 <12.3.5
>=13.0.0 <13.5.9
>=14.0.0 <14.2.25
>=15.0.0 <15.2.3

Patched in

14.2.25
15.2.3

Full technical detail▾

Overview

Next.js uses an internal x-middleware-subrequest header to prevent infinite middleware recursion. The check could be satisfied by an attacker-supplied value, causing the framework to skip middleware execution for the request.

Any security control implemented in middleware.ts — auth gates, redirects, header injection, geo/path restrictions — can be bypassed by sending the header directly.

Impact

Bypass of authentication/authorization enforced in middleware.
Access to protected routes/pages without valid session.
Affects self-hosted deployments using next start / standalone output. Sites on Vercel and Netlify were mitigated at the platform edge.

Proof of concept

GET /admin HTTP/1.1
Host: target.example
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

If /admin is gated only by middleware, the request reaches the route handler without the middleware ever running.

Remediation

Upgrade to 15.2.3, 14.2.25, 13.5.9, or 12.3.5.
If you cannot upgrade immediately, strip the x-middleware-subrequest header at your reverse proxy/WAF for all external requests.
Defense in depth: enforce authorization in the data/route layer, not middleware alone.

References

GitHub Advisory: https://github.com/advisories/GHSA-f82v-jwr5-mffw
Next.js advisory: https://nextjs.org/blog/cve-2025-29927

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nextjs#authz-bypass#web#middleware#exploit-available

← Back to feed

CVE-2025-29927Critical· 9.1▾ AbyssalPoC available

Next.js middleware authorization bypass via x-middleware-subrequest

A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score82/ 100 · Severe

impact 50.1 · likelihood 19.8 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

—

Updated

—

CVSS

9.1

Vendor

Next.js

Product

Next.js

CWE

CWE-285

Depth score

82 · Severe

EPSS

99% · p100

Platforms

Node.js, Web

Source

GHSA

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploit availability

Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.

checked 2026-09-21

Exploit-DB

Search Exploit-DB for CVE-2025-29927 ↗

GitHub PoCs

123 public repositories

Metasploit

auxiliary/scanner/http/nextjs_middleware_auth_bypass ↗

Nuclei

CVE-2025-29927.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 9.

99% → 99%▼ 0.08%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 75 days

Jul 9, 2026EPSS first tracked
99%
Sep 21, 2026Public exploit observed
Exploit-DB · 123 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)

Next.js CWE-285 #nextjs #authz-bypass #web #middleware #exploit-available

Affected

>=11.1.4 <12.3.5
>=13.0.0 <13.5.9
>=14.0.0 <14.2.25
>=15.0.0 <15.2.3

Patched in

14.2.25
15.2.3

Full technical detail▾

Overview

Any security control implemented in middleware.ts — auth gates, redirects, header injection, geo/path restrictions — can be bypassed by sending the header directly.

Impact

Bypass of authentication/authorization enforced in middleware.
Access to protected routes/pages without valid session.
Affects self-hosted deployments using next start / standalone output. Sites on Vercel and Netlify were mitigated at the platform edge.

Proof of concept

GET /admin HTTP/1.1
Host: target.example
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

If /admin is gated only by middleware, the request reaches the route handler without the middleware ever running.

Remediation

Upgrade to 15.2.3, 14.2.25, 13.5.9, or 12.3.5.
If you cannot upgrade immediately, strip the x-middleware-subrequest header at your reverse proxy/WAF for all external requests.
Defense in depth: enforce authorization in the data/route layer, not middleware alone.

References

GitHub Advisory: https://github.com/advisories/GHSA-f82v-jwr5-mffw
Next.js advisory: https://nextjs.org/blog/cve-2025-29927

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nextjs#authz-bypass#web#middleware#exploit-available