Summary:
A critical security flaw has been disclosed in the Next.js React framework that could be potentially exploited to bypass authorization checks under certain conditions.

The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.

"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops," Next.js said in an advisory.

"It was possible to skip running middleware, which could allow requests to skip critical checks—such as authorization cookie validation—before reaching routes." The company said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).

Security Officer Comments:
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application. Security researcher Rachid Allam (aka zhero and cold-try), who is credited with discovering and reporting the flaw, has since published additional technical details of the flaw, making it imperative that users move quickly to apply the fixes.

Link(s):
https://thehackernews.com/2025/03/critical-nextjs-vulnerability-allows.html