Open-source package vulnerability · npm

CVE-2025-29927: Authorization Bypass in Next.js Middleware

criticalCVSS 3.1 9.1GHSA-f82v-jwr5-mffw

Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround.

Published Mar 21, 2025 · Updated Mar 2, 2026

Affected packages

Ecosystem: npm
Affected: >= 13.0.0, < 13.5.9
Fixed in: 13.5.9
Check: npm ls next

Ecosystem: npm
Affected: >= 14.0.0, < 14.2.25
Fixed in: 14.2.25
Check: npm ls next

Ecosystem: npm
Affected: >= 15.0.0, < 15.2.3
Fixed in: 15.2.3
Check: npm ls next

Ecosystem: npm
Affected: >= 12.0.0, < 12.3.5
Fixed in: 12.3.5
Check: npm ls next

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
For Next.js 13.x, this issue is fixed in 13.5.9
For Next.js 12.x, this issue is fixed in 12.3.5
For Next.js 11.x, consult the below workaround.

_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

Allam Rachid (zhero;)
Allam Yasser (inzo_)

Credited to cold-try, Wenxin-Jiang.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries