The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and
    prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks
    within a Next.js application, if the authorization check occurs in middleware. If patching to a safe
    version is infeasible, it is recommend that you prevent external user requests which contain the
    x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in
    12.3.5, 13.5.9, 14.2.25, and 15.2.3. (CVE-2025-29927)

ID	Name	Product	Family	Published	Updated	Severity
114681	Next.js 13.0.x < 13.5.9 Authorization Bypass	Web App Scanning	Component Vulnerability	3/24/2025	4/4/2025	critical
114682	Next.js 14.x < 14.2.25 Authorization Bypass	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	critical
114683	Next.js 15.x < 15.2.3 Authorization Bypass	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	critical
114771	Next.js 11.1.4 < 12.3.5 Authorization Bypass	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	critical
421181	SCA: security update for next (GHSA-f82v-jwr5-mffw)	Tenable Self-Hosted Container Security	SCA Checks	3/21/2025	7/31/2026	critical
421181	SCA: security update for next (GHSA-f82v-jwr5-mffw)	Tenable Cloud Security	SCA Checks	3/21/2025	7/31/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical