Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Technical details are available for a critical Next.js authorization bypass flaw. Researchers are creating proof of concept exploits. Patching is strongly advised.

Researchers have observed exploit attempts targeting this vulnerability in Next.js probing potential servers. Organizations are strongly advised to patch.

The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
114771	Next.js 11.1.4 < 12.3.5 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114683	Next.js 15.x < 15.2.3 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114682	Next.js 14.x < 14.2.25 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114681	Next.js 13.0.x < 13.5.9 Authorization Bypass	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2025-29927

critical

Tenable Plugins

critical

critical

critical

critical