CVE-2025-29927
Critical
Description
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
SeverityCritical
CVSS9.1
Exploit probability100. percentile99.2%
Product
Vercel Next.js
PublishedMar 21, 2025
First seenMar 21, 2025
Weakness typeCWE-285CWE-285
How to fix
Update
- vercel next.js12.3.5, 13.5.9, 14.2.25, 15.2.3 or later
- next13.5.9, 14.2.25, 15.2.3, 12.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vercel next.js | 11.1.4 ≤ v < 12.3.5, 13.0.0 ≤ v < 13.5.9, 14.0.0 ≤ v < 14.2.25, 15.0.0 ≤ v < 15.2.3 | 12.3.5, 13.5.9, 14.2.25, 15.2.3 |
| nextnpm | 13.0.0 ≤ v < 13.5.9, 14.0.0 ≤ v < 14.2.25, 15.0.0 ≤ v < 15.2.3, 12.0.0 ≤ v < 12.3.5 | 13.5.9, 14.2.25, 15.2.3, 12.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.