Scientists see critical vulnerability in next.js If authorizations occur in middleware, they could be bypassed in older versions A patch and a temporary solution are both available, so update now
Experts have warned that there is a critical seriousness error in the next.J’s open source web development framework that allows threat players to bypass approval control.
Security researcher Rachid.a from Zhero Web Security published an in-depth analysis of the results with the vulnerability traced as CVE-2025-29927, and received a severity of 9.1/10 (critical).
Before versions 14.2.25 and 15.2.3, it was possible to bypass approval checks in Next.js if they happen in middleware.
Patching or mitigating
Next.JS is a popular react framework for building web applications that offer features such as Server-Side Rendering (SSR), Static Site Generation (SSG) and API routes.
It is widely used for SEO-friendly and high performance sites, including e-commerce platforms and dashboards.
Next.JS is supported by Vercel and is used by larger companies such as Netflix, Tiktok and GitHub, making it one of the most adopted framework for modern web development. It counts more than 9 million weekly downloads on NPM.
Middleware in Next.JS is a feature that runs before a request is completed, allowing developers to change requests and answers, handle approval or implement redirections. The feature is useful for tasks such as user approval, A/B tests and location without affecting side loading speed.
It was also stated that just self -hosted versions using ‘Next Start’ with ‘Output: Standalone’. Apps that host Vercel or Nerlify or implemented as static export are not affected.
Ideally, users must patch the above versions to mitigate any chances of exploitation. However, those who cannot use the patch so quickly are recommended to prevent external user requests containing X-MIDDLEWARE SUBREQUEST-HEADER from reaching the next JS application.
“This vulnerability has been present for several years in the next.j’s source code, which develops with the intermediate and its changes during versions,” the researcher concluded before emphasizing that Next.js is “widely used across critical sectors, from banking services to blockchain”.
Via Bleeping computer
You also like
