Next.js is an open-source web development framework from Vercel that provides React-based web applications with server-side and static rendering. In March 2025, details of a security vulnerability designated CVE-2025-29927 were published.
Background and exploitation of the security vulnerability
On 22 March 2025, Next.js announced a security vulnerability in the middleware layer that allowed authentication to be bypassed. Exploitation is trivial and can be achieved by sending an additional HTTP header with the content x-middleware-subrequest: true .
Severity and consequences of the security vulnerability
Affected versions and security controls
Patches are available:
-
Next.js 15.x: The issue was fixed in version 15.2.3.
-
Next.js 14.x: The issue was fixed in version 14.2.25.
-
Next.js 11.1.4 to 13.5.6: For these versions, it is recommended to use a workaround, as no direct patch is available.
x-middleware-subrequest from reaching the Next.js application.Scope of the vulnerability
According to Shodan, over 300,000 systems worldwide can be found with the header “X-Powered-By: Next.js”. In Germany, the service reports that over 33,000 systems are accessible. It is important to note that these are only the systems that are identifiable from the outside and publicly accessible; the number of affected systems that remain undiscovered is likely to be higher.
Over the past nine years, Next.js has published a total of 16 security advisories. The security vulnerability described here (CVE-2025-29927) is the first of these to be classified as critical. There is an urgent need for action; the security vulnerability should be patched as soon as possible. The researchers who discovered the security vulnerability explain in a detailed blog post how they found it.
How Mint Secure can help you
Critical framework vulnerabilities such as CVE-2025-29927 require swift and informed action; we are here to support you.
Incident Response
Rapid response and prioritisation when critical CVEs such as these are identified in your infrastructure.
Penetration Testing
Assessment of your web applications for known and unknown vulnerabilities in the framework and middleware.
Vulnerability Management
Continuous monitoring of relevant CVEs and advisories so that you can apply patches in good time.
Conclusion
CVE-2025-29927 is a critical security vulnerability, rated 9.1 on the CVSS scale, in the middleware layer of Next.js. A single manipulated HTTP header is enough to bypass authentication checks and expose application areas that are normally protected. Operators of affected versions should apply the patch immediately or, if that is not possible, filter out the header on the server side. Do you need help securing your Next.js applications? Get in touch with us.
