Next.js Middleware Bypass (CVE-2025-29927) Explained

Video transcript

One request header could skip the authorization checks in Next.js middleware. It needed no secret.

Disclosed March 21, 2025, it is rated Critical, with a CVSS score of 9.1. Affected versions reach back to 11.1.4.

Next.js uses an internal header to stop middleware loops, but accepted it from anyone. Name the middleware five times in its value, and Next.js skipped it.

Attackers could reach protected routes like admin pages and get responses without middleware security headers. In some setups, cached error pages could deny service.

Hosting decided exposure. Self-hosted next start and standalone builds were affected. Vercel, Netlify, Cloudflare Workers and static exports were not.

Guardian's November 2026 scan found 18 of 104 versioned crypto frontends on an affected release, 594 days after disclosure. A version match does not prove exploitability.

Internal signals need a boundary. And authorization placed only in middleware fails all at once.

Check your version against the fixed releases. If you cannot patch, strip the header at your proxy. Test a protected route with it, and recheck authorization where data is served.

Guardian's WebApp Pentest tests access control function by function, at every privilege level. Managed Security matches new disclosures against your systems in real time.

Read the full article for the timeline, or talk to Guardian about testing every route at every privilege level.

One request header could walk past the authorization checks in a Next.js app's middleware.

Affected versions reach back to 11.1.4, and the header needed no secret.

Its disclosure also exposed gaps in how a framework flaw is shared with the hosts and vendors built on it.

What the Flaw Is

Middleware runs before a request completes. The researchers who found the flaw list its uses: rewrites, redirects, security headers, and authentication and authorization.

GitHub's advisory states the impact: "It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware."

The advisory rates it Critical, with a CVSS score of 9.1. Rachid Allam (zhero) and Yasser Allam (inzo_) found it.

• Affected: 11.1.4 up to the fixed release in each line.
• Fixed: 15.2.3, 14.2.25, 13.5.9 and 12.3.5.
• 11.x: no patch; block the header before it reaches the app.

How the Bypass Works

Next.js uses an internal header, x-middleware-subrequest, to stop requests from looping through middleware.

Middleware runs in a separate process from page rendering. Vercel explains that the header tells the router that middleware has already run.

The flaw: Next.js accepted that header from anyone. If its value named the middleware, Next.js skipped the middleware.

The researchers list the values by project layout: pages/_middleware before 12.2, then middleware, or src/middleware with a src folder.

In the recent code the researchers examined (15.1.7), Next.js counts recursion to a depth of five. So the attacker repeats the name five times:

x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

What an attacker gets

• Protected routes, such as admin pages, with the middleware ignored.
• Responses without headers the middleware sets, such as a Content Security Policy.
• In some setups, error pages that a cache can store, denying service.

Where middleware does nothing security-relevant, skipping it bypasses no control, the researchers note.

The fix validates the header and filters it out when validation fails.

Exposure and Timeline

The same code was safe on one host and exposed on another.

Vercel's postmortem says its architecture made it "incidentally invulnerable."

Timeline

Cloudflare made its rule opt-in the same day. Sites using third-party auth vendors in middleware had seen requests fail.

On March 28, Datadog reported "a relatively low number of scans," calling them "small in volume, ineffective, and poorly targeted."

None of these sources reports a loss tied to the flaw.

Crypto frontends

Guardian's November 2026 scan of 249 top crypto sites by TVL found 18 of 104 versioned sites on an affected release.

Six used the App Router and 12 the Pages Router. Eleven showed no Vercel or Netlify headers, so their hosting does not rule them out.

The scan came 594 days after disclosure. Seventeen of the 18 run a release published before it.

A version match does not prove exploitability: the flaw matters only where middleware enforces authorization. See Next.js versions on crypto frontends for the full census.

What It Shows

• Internal signals need a boundary. A header meant for internal use was accepted from outside.
• One gate is not enough. Authorization only in middleware fails all at once.
• Triage speed matters. By Vercel's timeline, 15 days passed between the first report and escalation to the Next.js team.
• Disclosure has a supply chain. Vercel says it verified Netlify and Cloudflare Workers were not affected, but should have told them.

Vercel also says it could have communicated more proactively with other infrastructure providers and auth partners. It said it was opening a partner mailing list.

How to check your app

• Run npm ls next and compare with 15.2.3, 14.2.25, 13.5.9 and 12.3.5.
• If you cannot patch, strip x-middleware-subrequest at your proxy or edge.
• In a test environment, request a protected route with the header and confirm it is refused.
• Check authorization again where data is served, not only in middleware.
• List where each app is hosted; self-hosted builds carry the exposure.
• Watch Next.js security advisories on GitHub.

The other critical Next.js flaw of 2025 is covered in React2Shell explained.

How Guardian Tests This

Guardian's WebApp Pentest tests authorization: horizontal and vertical access control, and whether one user can reach another's resources.

Guardian maps the application function by function at every privilege level, then tests each one.

Under Managed Security, Guardian ingests vulnerability disclosures in real time and matches them against your system. An engineer confirms any exposure and works with you to patch it.

For the flows a crypto web app test should cover, read our guide to web application pentesting for crypto and fintech.

Frequently Asked Questions

What is CVE-2025-29927?

A critical authorization bypass in Next.js middleware, disclosed on March 21, 2025. Sending the internal x-middleware-subrequest header made Next.js skip middleware, so checks placed there did not run.

Which Next.js versions fix CVE-2025-29927?

15.2.3, 14.2.25, 13.5.9 and 12.3.5. Versions from 11.1.4 up to those releases are affected. 11.x has no patch, so GitHub's advisory says to block external requests carrying the header.

Were apps hosted on Vercel affected?

No. GitHub's advisory says Vercel deployments were automatically protected, and Vercel says Netlify and Cloudflare Workers were never affected. Static exports have no middleware. Self-hosted next start and standalone builds were exposed.

Was CVE-2025-29927 exploited?

Attackers scanned for it. On March 28, 2025, Datadog reported a relatively low number of scans, which it called small in volume, ineffective and poorly targeted.

Sources

• GitHub: GHSA-f82v-jwr5-mffw, Authorization Bypass in Next.js Middleware (March 21, 2025)
• NVD: CVE-2025-29927 (published March 21, 2025)
• Vercel: Postmortem on Next.js Middleware Bypass (March 25, 2025)
• Rachid Allam and Yasser Allam: Next.js and the corrupt middleware, the authorizing artifact (March 2025)
• Cloudflare: New Managed WAF rule for Next.js CVE-2025-29927 (March 22, 2025)
• Datadog Security Labs: Understanding CVE-2025-29927, The Next.js Middleware Authorization Bypass Vulnerability (March 28, 2025)
• Guardian: Next.js Versions on Crypto Frontends, Known Critical Flaws (November 2026)
• Guardian: Web Application Penetration Testing
• Guardian: Managed Security