---
title: "CVE-2025-29927: Authorization Bypass in Next.js Middleware"
url: https://erroneo.us/security/cve/CVE-2025-29927/
description: "CVE-2025-29927 (next (npm)): Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-03-21
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-29927"
kev: false
cvss: 9.1
epss: 0.99225
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-29927: Authorization Bypass in Next.js Middleware

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 99.2% , percentile 99.9: FIRST’s model estimates a 99.2% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes next (npm) >= 13.0.0, < 13.5.9, fixed in 13.5.9 ; next (npm) >= 14.0.0, < 14.2.25, fixed in 14.2.25 ; next (npm) >= 15.0.0, < 15.2.3, fixed in 15.2.3 ; next (npm) >= 12.0.0, < 12.3.5, fixed in 12.3.5 . Check your lockfile, including transitive dependencies.
- Editorial verdict: Check exposure. Next.js Middleware Authorization Bypass (CVE-2025-29927) — Patched since March 2025 and easy to fix; if you self-host Next.js and lean on middleware for auth, confirm you are on a fixed release and that the header is stripped at your edge.

## What it is

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

## Affected packages

- npm `next` >= 13.0.0, < 13.5.9 → fixed: 13.5.9
- npm `next` >= 14.0.0, < 14.2.25 → fixed: 14.2.25
- npm `next` >= 15.0.0, < 15.2.3 → fixed: 15.2.3
- npm `next` >= 12.0.0, < 12.3.5 → fixed: 12.3.5

## Affected products (CVE record)

- vercel next.js: >= 11.1.4, < 12.3.5, >= 14.0.0, < 14.2.25, >= 15.0.0, < 15.2.3, >= 13.0.0, < 13.5.9

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 99.22% probability of exploitation activity in the next 30 days; percentile 99.9.

## Sources

- [GitHub Advisory GHSA-f82v-jwr5-mffw](https://github.com/advisories/GHSA-f82v-jwr5-mffw)
- [CVE.org record CVE-2025-29927](https://www.cve.org/CVERecord?id=CVE-2025-29927)
- [NVD entry CVE-2025-29927](https://nvd.nist.gov/vuln/detail/CVE-2025-29927)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)
- [github.com](https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2)
- [github.com](https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48)
- [github.com](https://github.com/vercel/next.js/releases/tag/v12.3.5)
- [github.com](https://github.com/vercel/next.js/releases/tag/v13.5.9)
- [openwall.com](http://www.openwall.com/lists/oss-security/2025/03/23/3)
- [openwall.com](http://www.openwall.com/lists/oss-security/2025/03/23/4)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20250328-0002/)
- [vercel.com](https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware)

---
Source page: https://erroneo.us/security/cve/CVE-2025-29927/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt