CVE-2025-29927: vercel next.js Improper Authorization
Vulnerability summary
CVE-2025-29927 is a critical (CVSS 9.1) Improper Authorization vulnerability in vercel next.js. EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 21-03-2025PublishedVulnerability first disclosed.
- 08-04-2025Last modifiedVulnerability information updated.
Description
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
99.22%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundNext.js Middleware 15.2.2 - Authorization Bypass
Maturity: poc
Next.js Middleware Authorization Bypass Scanner
auxiliary/scanner/http/nextjs_middleware_auth_bypass
Maturity: poc
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Chainguard3 products
- jitsucom-jitsu< 2.9.0-r0
- jitsucom-jitsu-console< 2.9.0-r0
- jitsucom-jitsu-rotor< 2.9.0-r0
Wolfi3 products
- jitsucom-jitsu< 2.9.0-r0
- jitsucom-jitsu-console< 2.9.0-r0
- jitsucom-jitsu-rotor< 2.9.0-r0
Npm1 product
- next≥ 13.0.0, < 13.5.9 | ≥ 14.0.0, < 14.2.25 | ≥ 15.0.0, < 15.2.3 | ≥ 12.0.0, < 12.3.5
Vercel1 product
- next.js≥ 11.1.4, < 12.3.5 | ≥ 13.0.0, < 13.5.9 | ≥ 14.0.0, < 14.2.25 | ≥ 15.0.0, < 15.2.3
4 vendors · 8 products
References
13 links- github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffwX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2X Refsource MISCFIXWEBPatch
- github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48X Refsource MISCFIXWEBPatch
