Skip to content
CVE IDCVE-2025-29927GitHub advisory IDGHSA-f82v-jwr5-mffw

Authorization Bypass in Next.js Middleware

CVE-2025-29927 (GitHub advisory GHSA-f82v-jwr5-mffw) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.1, classed as Improper Authorization (CWE-285), in next (npm). Affected versions: >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5. It is fixed in 13.5.9, 14.2.25, 15.2.3 or 12.3.5, depending on the release line.

Critical9.1Fix availableGitHub reviewed

Published 21 Mar 2025Updated 2 Mar 2026

9.1CriticalCVSS 3.1
CVE ID
CVE-2025-29927
GHSA ID
GHSA-f82v-jwr5-mffw
EPSS
99.22%higher than 99.9% of CVEs
Weaknesses (CWE)
KEV status
Not in KEV
Published
21 Mar 2025
Updated
2 Mar 2026
Ecosystem
  • npm
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

  • For Next.js 15.x, this issue is fixed in 15.2.3
  • For Next.js 14.x, this issue is fixed in 14.2.25
  • For Next.js 13.x, this issue is fixed in 13.5.9
  • For Next.js 12.x, this issue is fixed in 12.3.5
  • For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

  • Allam Rachid (zhero;)
  • Allam Yasser (inzo_)

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Critical9.1Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
High
Integrity I
High
Availability A
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • next
    npm
    pkg:npm/next
    Affected versions
    >= 13.0.0, < 13.5.9
    >= 14.0.0, < 14.2.25
    >= 15.0.0, < 15.2.3
    >= 12.0.0, < 12.3.5
    Fixed in
    13.5.9
    14.2.25
    15.2.3
    12.3.5

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 13.5.9, 14.2.25, 15.2.3 or 12.3.5, depending on your release line.

Patch commits

  • 52a078dPatch commitgithub.com/vercel/next.js

    Update middleware request header (#77201)

    +35 −4 across 4 files

    • packages/next/src/server/lib/router-server.ts+7 −4
    • packages/next/src/server/lib/server-ipc/utils.ts+11 −0
    • packages/next/src/server/web/sandbox/context.ts+4 −0
    • test/e2e/middleware-general/test/index.test.ts+13 −0
  • 5fd3ae8Patch commitgithub.com/vercel/next.js

    [backport] Update middleware request header (#77202)

    +34 −0 across 4 files

    • packages/next/src/server/lib/router-server.ts+6 −0
    • packages/next/src/server/lib/server-ipc/utils.ts+11 −0
    • packages/next/src/server/web/sandbox/context.ts+4 −0
    • test/e2e/middleware-general/test/index.test.ts+13 −0

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 6687ab5Release commit12.3.5github.com/vercel/next.js
  • 422223eRelease commit13.5.9github.com/vercel/next.js
  • d36a1f3Release commit14.2.25github.com/vercel/next.js
  • 535e26dRelease commit15.2.3github.com/vercel/next.js

Vulnerability intelligence

References

Credits

Questions about CVE-2025-29927

What is the GHSA ID for CVE-2025-29927?
GitHub tracks CVE-2025-29927 as GHSA-f82v-jwr5-mffw.
What is the CVSS score of CVE-2025-29927?
CVE-2025-29927 has a CVSS 3.1 base score of 9.1 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Which versions are affected by CVE-2025-29927?
next (npm): >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5.
How do I fix CVE-2025-29927?
Upgrade to 13.5.9, 14.2.25, 15.2.3 or 12.3.5, depending on the release line. The fix is in commits 52a078d and 5fd3ae8.
What is the Package URL (PURL) for CVE-2025-29927?
The affected package's PURL is pkg:npm/next.
Is CVE-2025-29927 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-29927. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (14 Oct 2026, 17:43 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.