Exploited vulnerabilitiesBriefPublic record
Next.js middleware authorization bypass (CVE-2025-29927)
Disclosed 21 Mar 2025. A spoofed `x-middleware-subrequest` header skips middleware entirely.
- Disclosed
What happened
- Affected: self-hosted Next.js 11.1.4 to 15.2.2. Vercel-hosted deployments were not affected.
- Fixed: 15.2.3, 14.2.25, 13.5.9, 12.3.5.
- Exploited: mass scanning observed. Not in KEV.
Live scores
Live scores
CVE-2025-29927- EPSS
- 0.992
very likely to be attacked soon - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Not listed
Sources
- https://nextjs.org/blog/cve-2025-29927
- https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.