---
id: CVE-2025-29927
title: Next.js middleware authorization bypass via x-middleware-subrequest
summary: >-
  A crafted x-middleware-subrequest header lets an attacker skip Next.js
  middleware execution entirely, bypassing authentication/authorization checks
  implemented in middleware.
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe: CWE-285
vendor: Next.js
product: Next.js
platforms:
  - Node.js
  - Web
affected:
  - '>=11.1.4 <12.3.5'
  - '>=13.0.0 <13.5.9'
  - '>=14.0.0 <14.2.25'
  - '>=15.0.0 <15.2.3'
patched:
  - 14.2.25
  - 15.2.3
exploited: false
zeroDay: false
epss: 0.99225
epssPercentile: 0.99935
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-f82v-jwr5-mffw'
references:
  - url: 'https://github.com/advisories/GHSA-f82v-jwr5-mffw'
    label: GitHub Advisory
  - url: 'https://nextjs.org/blog/cve-2025-29927'
    label: Next.js advisory
tags:
  - nextjs
  - authz-bypass
  - web
  - middleware
  - exploit-available
ecosystem: Vercel
exploitAvailable: true
exploits:
  exploitdb: true
  github: 123
  githubRepos:
    - 'https://github.com/serhalp/test-cve-2025-29927'
    - 'https://github.com/Ademking/CVE-2025-29927'
    - 'https://github.com/6mile/nextjs-CVE-2025-29927'
  metasploit:
    - auxiliary/scanner/http/nextjs_middleware_auth_bypass
  nuclei:
    - CVE-2025-29927
  checkedAt: '2026-09-23T07:13:13.801Z'
---

## Overview

Next.js uses an internal `x-middleware-subrequest` header to prevent infinite
middleware recursion. The check could be satisfied by an attacker-supplied value,
causing the framework to **skip middleware execution** for the request.

Any security control implemented in `middleware.ts` — auth gates, redirects, header
injection, geo/path restrictions — can be bypassed by sending the header directly.

## Impact

- Bypass of authentication/authorization enforced in middleware.
- Access to protected routes/pages without valid session.
- Affects self-hosted deployments using `next start` / standalone output. Sites on
  Vercel and Netlify were mitigated at the platform edge.

## Proof of concept

```http
GET /admin HTTP/1.1
Host: target.example
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
```

If `/admin` is gated only by middleware, the request reaches the route handler
without the middleware ever running.

## Remediation

1. Upgrade to **15.2.3**, **14.2.25**, **13.5.9**, or **12.3.5**.
2. If you cannot upgrade immediately, strip the `x-middleware-subrequest` header at
   your reverse proxy/WAF for all external requests.
3. Defense in depth: enforce authorization in the data/route layer, not middleware
   alone.

## References

- GitHub Advisory: <https://github.com/advisories/GHSA-f82v-jwr5-mffw>
- Next.js advisory: <https://nextjs.org/blog/cve-2025-29927>