>=14.0.0 vulnerabilities

CVEs whose affected-version data names the >=14.0.0 package (Vercel). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-29927Critical· 9.1PoC

Next.js middleware authorization bypass via x-middleware-subrequest

A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.

▾ AbyssalNext.js · Next.jsNode.js, WebEPSS 99%via GHSA