Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Technical details are available for a critical Next.js authorization bypass flaw. Researchers are creating proof of concept exploits. Patching is strongly advised.

Researchers have observed exploit attempts targeting this vulnerability in Next.js probing potential servers. Organizations are strongly advised to patch.

The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and
    prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks
    within a Next.js application, if the authorization check occurs in middleware. If patching to a safe
    version is infeasible, it is recommend that you prevent external user requests which contain the
    x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in
    12.3.5, 13.5.9, 14.2.25, and 15.2.3. (CVE-2025-29927)

ID	Name	Product	Family	Severity
114771	Next.js 11.1.4 < 12.3.5 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114683	Next.js 15.x < 15.2.3 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114682	Next.js 14.x < 14.2.25 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
114681	Next.js 13.0.x < 13.5.9 Authorization Bypass	Web App Scanning	Component Vulnerability	critical
421181	SCA: security update for next (GHSA-f82v-jwr5-mffw)	Tenable Cloud Security	SCA Checks	critical
421181	SCA: security update for next (GHSA-f82v-jwr5-mffw)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-29927

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical