CVE-2025-29927

Summary

CVE-2025-29927 is a vulnerability affecting Next.js, a popular React framework for building full-stack web applications.Versions prior to 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are susceptible to bypassing authorization checks within Next.js applications, specifically when the checks take place in middleware. Malicious users could exploit this flaw to gain unauthorized access to protected resources. If upgrading to a secure version is unfeasible, it is advised to block external user requests containing the x-middleware-subrequest header from reaching your Next.js application. This vulnerability has been resolved in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.