If your company runs Next.js App Router in production, upgrading the version after a security advisory isn't enough to consider yourself patched. The critical middleware vulnerability CVE-2025-29927 (March 2025) remained exploitable in self-hosted deployments that didn't strip the x-middleware-subrequest header at their reverse proxy.
The patch that didn't close the hole on its own: CVE-2025-29927
An external client could add the x-middleware-subrequest header to its own request, causing Next.js to treat the call as internal and skip middleware execution entirely, including any session or role checks living there.
Why upgrading alone doesn't close the gap if you're self-hosted
On a self-hosted deployment, stripping that header at the reverse proxy is your responsibility; the code patch doesn't add it automatically.
The design flaw no patch fixes: authentication living only in middleware
Many teams put all authorization logic in middleware.ts, which often only checks for a cookie's existence, not real permissions on the requested resource.
- Confirm deployed Next.js version
- Review header filtering at the proxy
- Audit middleware.ts logic
- Revalidate session in Server Components and Route Handlers
- Review the matcher after new routes
If you run Next.js App Router in production and aren't sure your middleware truly protects every route, Blurtek reviews the full configuration before it becomes an incident.
Solicitar diagnóstico