[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Critical Middleware Vulnerability in Next.js (CVE-2025-29927)](/blog/critical-middleware-bypass-vulnerability-in-next-js-cve-2025-29927) Publish date July 25, 2025 {x} minute read # Critical Middleware Vulnerability in Next.js (CVE-2025-29927) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/comprehensive-guide-to-preventing-supply-chain-attacks) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Comprehensive Guide to Preventing Supply Chain Attacks Free resource ### A Comprehensive Guide to Preventing Supply Chain Attacks [Download now](/resources/comprehensive-guide-to-preventing-supply-chain-attacks) Researchers have discovered a critical security vulnerability in Next.js that allows attackers to easily bypass middleware authorization measures. The vulnerability, designated CVE-2025-29927, was discovered by [Rachid Allam and Yasser Allam](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware) and since assigned a base CVSS score of 9.1. By skipping checks for authorization cookies, attackers can potentially gain access to restricted areas of applications like admin tools and dashboards. Because of the ease of exploitation and high impact, this vulnerability poses a significant risk to affected systems. ​ ## What is CVE-2025-29927? CVE-2025-29927 is a critical vulnerability in Next.js, a popular React-based web framework, that was [publicly disclosed in March 2025](https://nextjs.org/blog/cve-2025-29927). It affects self-hosted applications running versions 11.1.4 through 15.2.2 using the **`next start `**command with output: **`'standalone'`.** The vulnerability allows attackers to bypass authorization middleware by injecting a specially crafted x-middleware-subrequest HTTP header, granting unauthorized access to protected resources. With a CVSS score of 9.1, this flaw poses a serious security risk, particularly for applications that rely solely on middleware for access control without implementing additional server-side authorization checks. While deployments on platforms like Vercel or using static exports are not affected, self-hosted instances must be promptly updated or reconfigured to mitigate potential exploitation. ## Affected Versions and Fixes CVE-2025-29927 impacts self-hosted Next.js applications running versions **11.1.4 through 15.2.2**, specifically when deployed using the **`next start `**command with the output: **`'standalone'`** configuration. The vulnerability is present in environments where applications rely solely on **middleware-based authorization**, without implementing additional server-side authentication or access control mechanisms. A key condition for exploitation is the acceptance of the **`x-middleware-subrequest`** HTTP header from external sources, which can be used by attackers to trick the application into bypassing middleware logic. Applications deployed on **Vercel**, **Netlify**, or as **static exports** are not vulnerable, as those environments do not expose the middleware in a way that can be exploited. The issue has been patched in the following versions: **15.2.3**, **14.2.25**, **13.5.9**, and **12.3.5**, and all users are strongly encouraged to upgrade to these or later versions to mitigate the risk. ## Steps to Remediate or Mitigate the Vulnerability To address CVE-2025-29927, consider the following actions: 1. **Update Next.js:** Upgrade to the latest patched versions:​ * For Next.js 15.x, update to version 15.2.3.​ * For Next.js 14.x, update to version 14.2.25. * For Next.js 13.x, update to version 13.5.9.​ * For Next.js 12.x, update to version 12.3.5. 2. **Implement workarounds if immediate patching isn't possible:\ ** * **Filter incoming requests:** Configure load balancers or reverse proxies to remove the **`x-middleware-subrequest`** header from incoming requests. * **Web server configuration:** For Nginx, use the **`proxy_set_header`** directive to set **`x-middleware-subrequest`** to an empty value. In Apache, utilize the **`RequestHeader`** unset directive to remove the header. 3. **Enhance authorization mechanisms:\ ** * Implement additional server-side authorization checks beyond middleware to validate user permissions. ## Previous Notable Vulnerabilities in Next.js Monitoring your assets and vendors using Next.js is an important part of an ongoing security program. Next.js has disclosed several vulnerabilities in the past and, like all software, will have more in the future. Examples of prior issues– and reasons to continue monitoring for Next.js vulnerabilities– include:​ * **Denial of service (DoS) with server actions (January 2025):** This vulnerability could be exploited to cause service disruptions. * **Authorization bypass in Next.js (December 2024):** A high-severity flaw that allowed unauthorized access under certain conditions.[\ \ ](https://thehackernews.com/2025/03/critical-nextjs-vulnerability-allows.html?utm_source=chatgpt.com) * **HTTP request smuggling (May 2024):** This issue could enable attackers to interfere with the processing of HTTP requests between clients and servers.[ ](https://www.picussecurity.com/resource/blog/cve-2025-29927-nextjs-middleware-bypass-vulnerability?utm_source=chatgpt.com) ‍ ## How UpGuard Helps The UpGuard platform detects CVE-2025-29927 using a two step verification mechanism that determines whether Middleware headers are leaked and then checks for sensitive, accessible content. When the vulnerability has been confirmed, it can be found in the UpGuard platform. Amongst the S\&P 500, the Next.js vulnerability has been detected on IP addresses for 23 companies. The vulnerability can be identified on individual domains or IPs, or across all vendors in the Portfolio Risk Profile view. Any vendors that are vulnerable to CVE-2025-29927 should be contacted to speed remediation, as discovery and exploitation of this vulnerability is trivial. eBook A Comprehensive Guide to Preventing Supply Chain Attacks Free resource ### A Comprehensive Guide to Preventing Supply Chain Attacks [Download now](/resources/comprehensive-guide-to-preventing-supply-chain-attacks) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Risks and Vulnerabilities #### [Understanding and Mitigating CVE-2025-55182 (React2Shell)](/blog/understanding-and-mitigating-cve-2025-55182-react2shell) CVE-2025-55182 is a critical unauthenticated RCE in React Server Components (CVSS 10.0). Check if your Next.js or React 19 app is vulnerable and patch now. [](/team/edward-kost) [Edward Kost](#) December 14, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)