CVE-2025-29927: The Next.js Authorization Bypass Still Unpatched

CVE-2025-29927 lets attackers bypass Next.js authentication by adding the x-middleware-subrequest header to any HTTP request. It affects versions before 12.3.5, 13.5.9, 14.2.25 and 15.2.3, with CVSS 9.1 (NVD). It is not remote code execution: it's an authorization bypass (CWE-284). Many self-hosted deployments remain exposed months after the patch.

Registered as GHSA-f82v-jwr5-mffw and classified as CWE-284, improper access control, this bug does not grant an attacker code execution. It tricks the server into believing a check already passed when it never did. The 9.1 score reflects ease of exploitation — network vector, no authentication, low complexity — not payload severity, since the payload is simply an HTTP header.

Next.js uses this header internally to prevent infinite loops when middleware triggers a subrequest that would re-enter the same middleware chain. The flaw is that this header traveled as an ordinary HTTP header, with no validation that only the internal runtime could set it. Any external client could craft it manually and get the middleware skipped entirely, auth checks included.

Vercel's edge infrastructure normalizes internal headers before requests reach application code, which neutralized many external injection attempts regardless of patch status. Self-hosted deployments — Docker containers, standalone Node servers, generic nginx setups — lack that intermediate layer, which is why many instances remain exposed without anyone noticing, since exploitation causes no visible failure.

• Check the Next.js version on every active deployment, not just the repository.
• Upgrade to the patched version for your major branch.
• If you can't upgrade immediately, strip the x-middleware-subrequest header at your reverse proxy.
• Replicate any middleware-only authorization logic explicitly in each route handler serving sensitive data.