~ / search / GHSA-f82v-jwr5-mffw

GHSA-f82v-jwr5-mffw

Authorization Bypass in Next.js Middleware

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-29927

Packages

EcosystemPackageAffectedFixed in
npm next >= 13.0.0, < 13.5.9 13.5.9
npm next >= 14.0.0, < 14.2.25 14.2.25
npm next >= 15.0.0, < 15.2.3 15.2.3
npm next >= 12.0.0, < 12.3.5 12.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

# Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. # Patches * For Next.js 15.x, this issue is fixed in `15.2.3` * For Next.js 14.x, this issue is fixed in `14.2.25` * For Next.js 13.x, this issue is fixed in 13.5.9 * For Next.js 12.x, this issue is fixed in 12.3.5 * For Next.js 11.x, consult the below workaround. _Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._ # Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application. ## Credits - Allam Rachid (zhero;) - Allam Yasser (inzo_)

References

External links from the advisory. They lead to third-party sites.