A newly disclosed vulnerability in the Next.js React framework has been assigned a CVSS score of 9.1, marking it as a critical security risk. Tracked as CVE-2025-29927, the flaw can be exploited under specific conditions to bypass middleware-based authorization checks, potentially allowing unauthorized access to privileged resources.
The issue stems from how Next.js handles the x-middleware-subrequest header, which is internally used to prevent infinite request loops. If manipulated, this header can be used to skip middleware execution, letting attackers bypass cookie-based authorization checks before reaching sensitive routes.
Security researcher Rachid Allam (also known as zhero and cold-try), who discovered the flaw, has published technical details, making it crucial for developers to act quickly.
Patch for CVE-2025-29927 Available for Multiple Versions
The Next.js team has addressed the vulnerability in the following versions:
- 12.3.5
- 13.5.9
- 14.2.25
- 15.2.3
Users who cannot immediately update are advised to >block any external requests containing the x-middleware-subrequest header from reaching their applications to reduce exposure.
Risk to Middleware-Only Authorization
According to JFrog, any application relying solely on middleware for user authorization without layered security measures is vulnerable. Attackers can exploit this flaw to gain access to pages reserved for administrators or users with elevated privileges—making it a serious concern for web applications handling sensitive data.
In light of the detailed disclosure and active interest in this vulnerability, developers are urged to apply the latest patches or adopt mitigation strategies as soon as possible.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: