# CVE-2025-29927: Authorization Bypass in Next.js Middleware

> CVE-2025-29927 (GitHub advisory GHSA-f82v-jwr5-mffw) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.1, classed as Improper Authorization (CWE-285), in next (npm). Affected versions: >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5. It is fixed in 13.5.9, 14.2.25, 15.2.3 or 12.3.5, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-29927

| Field | Value |
| --- | --- |
| CVE | CVE-2025-29927 |
| GHSA | GHSA-f82v-jwr5-mffw |
| Severity | Critical |
| CVSS 3.1 | 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-285 Improper Authorization; CWE-863 Incorrect Authorization |
| EPSS | 99.22% (higher than 99.9% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact total |
| Published | 21 Mar 2025 |
| Modified | 2 Mar 2026 |

## Description

### Impact
It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

### Patches
* For Next.js 15.x, this issue is fixed in `15.2.3`
* For Next.js 14.x, this issue is fixed in `14.2.25`
* For Next.js 13.x, this issue is fixed in 13.5.9
* For Next.js 12.x, this issue is fixed in 12.3.5
* For Next.js 11.x, consult the below workaround.

_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._

### Workaround
If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.

#### Credits

- Allam Rachid (zhero;)
- Allam Yasser (inzo_)

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| next | npm | `pkg:npm/next` | >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5 | 13.5.9, 14.2.25, 15.2.3, 12.3.5 |

## Fix commits

- Patch: https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
- Patch: https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
- Release: https://github.com/vercel/next.js/commit/6687ab55a362f1fe8cb15a76640cc87ff90d15f2 (12.3.5)
- Release: https://github.com/vercel/next.js/commit/422223e929723dfe7a19f3efe22e38929e9fae79 (13.5.9)
- Release: https://github.com/vercel/next.js/commit/d36a1f3c3547b0cb807f30c14aa6250a932349c8 (14.2.25)
- Release: https://github.com/vercel/next.js/commit/535e26d3c69de49df8bd17618a424cbe65ec897b (15.2.3)

## Questions

**What is the GHSA ID for CVE-2025-29927?**

GitHub tracks CVE-2025-29927 as GHSA-f82v-jwr5-mffw.

**What is the CVSS score of CVE-2025-29927?**

CVE-2025-29927 has a CVSS 3.1 base score of 9.1 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

**Which versions are affected by CVE-2025-29927?**

next (npm): >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5.

**How do I fix CVE-2025-29927?**

Upgrade to 13.5.9, 14.2.25, 15.2.3 or 12.3.5, depending on the release line. The fix is in commits 52a078d and 5fd3ae8.

**What is the Package URL (PURL) for CVE-2025-29927?**

The affected package's PURL is pkg:npm/next.

**Is CVE-2025-29927 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-29927. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

## References

- https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2 (fix)
- https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48 (fix)
- https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2025-29927 (advisory)
- https://security.netapp.com/advisory/ntap-20250328-0002 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29927.json (advisory)
- https://github.com/advisories/GHSA-f82v-jwr5-mffw (advisory)
- https://github.com/vercel/next.js (package)
- https://github.com/vercel/next.js/releases/tag/v12.3.5
- https://github.com/vercel/next.js/releases/tag/v13.5.9
- https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
- http://www.openwall.com/lists/oss-security/2025/03/23/3
- http://www.openwall.com/lists/oss-security/2025/03/23/4

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-29927), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.