Critical Flaw in Next.js lets Attackers bypass Authorization.
A recent collaborative effort by researchers Rachid Allam and Yasser Allam has exposed a critical vulnerability within the Next.js framework, a widely used JavaScript framework based on React with nearly 10 million weekly downloads.
https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
![[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops," Next.js said in an advisory. "It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes."
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️](https://nerdculture.de/system/media_attachments/files/114/234/341/495/174/533/original/d2d061af71c4a9f2.jpeg "[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
\"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops,\" Next.js said in an advisory. \"It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes.\"
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️")
Red Hat Middleware moving to IBM http://markclittle.blogspot.com/2025/03/red-hat-middleware-moving-to-ibm.html by @nmcl
#redhat #ibm #middleware
»Critical Next.js Middleware Vulnerability Allows Attackers to Bypass Authorization:
A severe vulnerability has been identified in Next.js, a popular React framework used for building web applications, under the designation CVE-2025-29927.«
Well, I have to give it up and look at it.
https://gbhackers.com/critical-next-js-middleware-vulnerability/
Critical Next.js Middleware Vulnerability (CVE-2025-29927)
A major auth bypass vulnerability in Next.js middleware (prior to v14.2.25 / v15.2.3) allows attackers to inject the x-middleware-subrequest header and bypass authorization entirely. Exploitable via simple HTTP requests—no user interaction, no special permissions.
Patch. Now. Or block the header manually.
GitHub scored this 9.1 CRITICAL, but the real issue? This flaw exposes a systemic weakness in middleware validation, and some vendors weren’t exactly upfront about the risks.
Details + POC: https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-auth-bypass
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-29927
Security theater is easy. Secure defaults and transparency are harder—but essential.
Unlocking the Power of Functional Programming: Lessons in Simplicity and Composition
In a world dominated by imperative programming, functional programming offers a refreshing perspective on code architecture and composition. This article explores the fundamental concepts of Haskell a...
@mookie also wothput #Backend or #Middleware we'd constantly see #Skiddies fuck up everything!
