Advisory VV-007critical2025-03
CVE-2025-29927: Next.js middleware authorization bypass
Self-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0.
What it is
GitHub Advisory: "It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware." Fixed in 15.2.3, 14.2.25, 13.5.9 and 12.3.5.
Deployments hosted on Vercel were automatically protected; Vercel’s postmortem notes static exports were not affected because they have no middleware.
How to check
- Run npm ls next and compare with the fixed versions.
How to fix
- Upgrade Next.js. If you cannot, strip the x-middleware-subrequest header from external requests at your proxy/WAF.
npm ls next
# Upgrade to a patched release, e.g.
npm install next@latest