CVE-2025-29927

An attacker sends an HTTP request containing a specially crafted x-middleware-subrequest header. Next.js treats such a request as an internal middleware subrequest and skips the execution of authorization logic defined in the middleware layer. As a result, access controls — regardless of their implementation — are ignored, and the request reaches protected resources without permission verification. The issue affects all authorization checks placed solely in middleware.

An attacker can gain unauthorized access to protected application resources and manipulate data to which they should not normally have permissions, which constitutes a breach of confidentiality and integrity (CWE-285, CWE-863).

Next.js should be updated to version 12.3.5, 13.5.9, 14.2.25, or 15.2.3. If an immediate update is not possible, the vendor recommends blocking at the infrastructure level (reverse proxy, firewall, load balancer) all incoming external requests containing the x-middleware-subrequest header, so they do not reach the Next.js application.

Next.js versions from 1.11.4 to 12.3.4, from 13.0.0 to 13.5.8, from 14.0.0 to 14.2.24, and from 15.0.0 to 15.2.2 — all variants based on Vercel's Next.js framework where authorization logic is implemented in middleware.