Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Next.js may let attackers bypass login checks

CVE-2025-29927 · published 1 year ago
Summary

Versions of the Next.js web framework up to 12.3.4, 13.5.8, 14.2.24 and 15.2.2 can be tricked into skipping the permission checks that protect parts of your site. An attacker could send a special header (x-middleware-subrequest) and gain access to restricted pages. Update to the latest release of Next.js, or if you cannot update, configure your server to reject any request that contains that header.

What to do
  • Update vercel-release-bot next to version 13.5.9.
  • Update vercel-release-bot next to version 14.2.25.
  • Update vercel-release-bot next to version 15.2.3.
  • Update vercel-release-bot next to version 12.3.5.
  • Update next to version 12.3.4-aikido.2.
  • Update rootio @rootio/next to version 12.3.4-root.io.2.
  • Update next to version 14.2.24-aikido.1.
  • Update rootio @rootio/next to version 14.2.24-root.io.1.
  • Update next to version 13.2.4-aikido.2.
  • Update rootio @rootio/next to version 13.2.4-root.io.2.
  • Update next to version 14.1.4-aikido.3.
  • Update rootio @rootio/next to version 14.1.4-root.io.3.
  • Update next to version 14.2.0-aikido.1.
  • Update rootio @rootio/next to version 14.2.0-root.io.1.
  • Update next to version 14.2.16-aikido.1.
  • Update rootio @rootio/next to version 14.2.16-root.io.1.
  • Update next to version 14.0.3-aikido.2.
  • Update rootio @rootio/next to version 14.0.3-root.io.2.
  • Update next to version 14.2.25-aikido.1.
  • Update rootio @rootio/next to version 14.2.25-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
npm vercel-release-bot next >= 13.0.0, < 13.5.9
>= 14.0.0, < 14.2.25
>= 15.0.0, < 15.2.3
>= 12.0.0, < 12.3.5
Fix: upgrade to 13.5.9
– vercel next.js >= 11.1.4, < 12.3.5
>= 13.0.0, < 13.5.9
>= 14.0.0, < 14.2.25
>= 15.0.0, < 15.2.3
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
Root:npm – next < 12.3.4-aikido.2
< 14.2.24-aikido.1
< 13.2.4-aikido.2
< 14.1.4-aikido.3
< 14.2.0-aikido.1
< 14.2.16-aikido.1
< 14.0.3-aikido.2
< 14.2.25-aikido.1
Fix: upgrade to 12.3.4-aikido.2
Root:npm rootio @rootio/next < 12.3.4-root.io.2
< 14.2.24-root.io.1
< 13.2.4-root.io.2
< 14.1.4-root.io.3
< 14.2.0-root.io.1
< 14.2.16-root.io.1
< 14.0.3-root.io.2
< 14.2.25-root.io.1
Fix: upgrade to 12.3.4-root.io.2
Original advisory text
CVE-2025-29927 in next - Patched by Root
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
99% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published21 Mar 2025
Updated30 Sep 2026
First seen6 Mar 2026
Sources
GHSA-f82v-jwr5-mffw · GHSA
CVE-2025-29927 · NVD
GHSA-f82v-jwr5-mffw · OSV
ROOT-APP-NPM-CVE-2025-29927 · OSV
Track software like this
Free during beta