CVE-2025-29927: Next.js middleware authorization bypass via x-middleware-subrequest header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.1 with network reachability, no authentication or interaction required, and an EPSS probability above 0.99 make this a high-urgency authorization bypass.

What it is

Next.js versions from 1.11.4 up to (but not including) 12.3.5, 13.5.9, 14.2.25, and 15.2.3 allow authorization checks performed in middleware to be bypassed. An attacker can reach protected routes or actions that the middleware was meant to guard, which matters because middleware is a common place to enforce auth in Next.js apps.

Impact

An attacker can skip middleware-based authorization and access functionality or data that should require authentication or specific privileges. The CVSS vector indicates high confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via HTTP requests to a vulnerable Next.js application; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The flaw is triggered when authorization logic lives in middleware and the request carries the x-middleware-subrequest header.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high (0.99225, 99.935th percentile), indicating strong likelihood of exploitation activity. References are patch, release note, vendor advisory and third-party advisory tags only, with no public exploit tag supplied.

What to do

• Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3 (or later) as applicable to your major version.
• If patching is not immediately possible, block or strip external requests containing the x-middleware-subrequest header before they reach the Next.js application.
• Do not rely solely on middleware for authorization; enforce authorization checks in the route handlers, server actions, or API layer as defense in depth.
• Audit middleware-protected routes to identify which ones would be exposed if the bypass occurred, and prioritize those for patching.
• Monitor vendor advisory GHSA-f82v-jwr5-mffw and related release notes for updates.

Detection

• Search web/proxy logs for requests containing the x-middleware-subrequest header, especially from external clients.
• Alert on access to middleware-protected routes that lack a valid authenticated session.
• Review application logs for authorization decisions made only in middleware and correlate with unexpected access patterns.
• Baseline normal header sets and flag anomalous or unexpected x-middleware-* headers in inbound traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.