CVE-2025-29927

Severity CVSS v4.0:

Pending analysis

Type:

CWE-285 Improper Authorization

Publication date:

21/03/2025

Last modified:

10/09/2025

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 9.10 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): None

Base Score 3.x

9.10

Severity 3.x

CRITICAL

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:vercel:next.js::::::node.js::*	11.1.4 (including)	12.3.5 (excluding)
cpe:2.3:a:vercel:next.js::::::node.js::*	13.0.0 (including)	13.5.9 (excluding)
cpe:2.3:a:vercel:next.js::::::node.js::*	14.0.0 (including)	14.2.25 (excluding)
cpe:2.3:a:vercel:next.js::::::node.js::*	15.0.0 (including)	15.2.3 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2025-29927

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools