Critical Next.js Framework Vulnerability Let Attackers Bypass Authorization

Cybersecurity

A critical security vulnerability has been identified in the Next.js framework, designated CVE-2025-29927. This vulnerability allows unauthorized access to web applications, bypassing authorization mechanisms.

Technical Details

The vulnerability is caused by improper handling of the x-middleware-subrequest header during Next.js middleware execution. This flaw can expose sensitive administrative areas and protected resources to unauthorized access.

Various versions of the React-based web framework Next.js are affected, with exploitation techniques differing based on the version in use.

Key Takeaways

• CVE-2025-29927 exploits x-middleware-subrequest to bypass Next.js authorization.
• Attackers manipulate the header to match middleware names, skipping authorization checks.
• Implementation of layered security is advised to mitigate risks.

Vulnerability Impact

The vulnerability’s core issue is located in the middleware processing logic of Next.js, specifically in its handling of the x-middleware-subrequest header. Originally designed to prevent infinite middleware loops by identifying internal subrequests, the flawed implementation allows external requests to bypass authorization checks.

Exploitation varies across different Next.js versions:

• Version 12.2 and Earlier: Attackers use x-middleware-subrequest: pages/_middleware to bypass middleware in the pages directory.
• Version 12.2 and Later: The header value changes to x-middleware-subrequest: middleware for files named middleware.ts.
• Version 13.2.0 and Later: Despite recursion depth protections, the vulnerability persists through repeated middleware names in the header.

The vulnerability is particularly severe when combined with JSON Web Token (JWT) or cookie-based authentication systems, allowing complete circumvention of token validation.

Risk Factors

Organizations using Next.js should evaluate their middleware implementations and apply security patches promptly.

This vulnerability underscores the importance of implementing defense-in-depth strategies, ensuring authorization controls exist at multiple layers rather than relying solely on middleware-based protection mechanisms.