Loading story…
A critical vulnerability in Next.js tracked as CVE-2025-29927 allows attackers to bypass authorization controls when applications rely on Middleware for access checks under specific deployment conditions. Researchers showed that specially crafted requests using the x-middleware-subrequest header can cause Middleware processing to be skipped, forwarding requests directly to protected endpoints. The issue was described as an authorization bypass with a CVSS 9.1 severity rating and was later detailed by the Next.js team in a postmortem.
The flaw affects multiple Next.js release lines, with fixes released in 15.2.3, 14.2.25, 13.5.9, and 12.3.5. Guidance from defenders and the vendor says organizations should patch immediately, and those unable to update should block external requests containing the x-middleware-subrequest header. The exposure is tied to applications run with next start using the output: 'standalone' setting, while hosted Next.js deployments on Vercel and Netlify were reported as protected from this issue.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK published an advisory on the critical Next.js flaw, summarizing affected versions, patched releases, and the recommendation to block external requests carrying the x-middleware-subrequest header if patching was not immediately possible. The notice also stated that Vercel- and Netlify-hosted instances were protected.
Next.js publicly disclosed CVE-2025-29927, a critical authorization bypass affecting applications that rely on Middleware for auth checks in certain deployment configurations. Patched releases were made available for multiple supported branches, including 15.2.3, 14.2.25, 13.5.9, and 12.3.5.
Zhero Web Security published research describing how the x-middleware-subrequest header could be abused to bypass authorization checks implemented in Next.js Middleware. The write-up publicly documented the issue's mechanics before the vendor postmortem.
According to Next.js's postmortem, Vercel received a private report from researchers about an authorization bypass involving Next.js Middleware and the x-middleware-subrequest header. This initiated the coordinated response to what became CVE-2025-29927.
Assetnote reported that common public checks could miss redirect-based Next.js middleware implementations because expected middleware headers may not be exposed. It described using x-nextjs-data to reveal redirect or rewrite indicators, consolidating middleware-path tests in X-Middleware-Subrequest, and filtering locale redirects to reduce scanning false positives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourcecsirt.sk
Open sourcenextjs.org
Open sourcezhero-web-sec.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **Next.js** flaw tracked as `CVE-2025-29927` exposed applications using middleware-based authorization to authentication and authorization bypass, allowing protected routes to be reached without intended access checks. Public reporting described the issue as a middleware bypass bug affecting deployments that relied on Next.js middleware for security decisions, prompting urgent guidance for defenders to identify exposed internet-facing applications and remediate vulnerable implementations. The vulnerability was rapidly operationalized after disclosure, with multiple GitHub repositories publishing **proof-of-concept exploits**, vulnerable demo apps, Docker labs, and automated detection tools. These included scanners and hunters designed to identify susceptible Next.js sites, as well as exploitation-focused projects advertising middleware auth bypass and route access validation, increasing the likelihood of broad reconnaissance and opportunistic abuse against unpatched environments.
Jul 12, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026