CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2025-29927
Critical (9.1) in vercel next.js. EPSS 99% chance of exploitation in the next 30 days. Fixed in next 12.3.5, 13.5.9, 14.2.25.
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Severity
- EPSS
- 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-863, CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vercel:next.js
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f82v-jwr5-mffw | npm | next | >=13.0.0 <13.5.9 | 13.5.9 |
| GHSA-f82v-jwr5-mffw | npm | next | >=14.0.0 <14.2.25 | 14.2.25 |
| GHSA-f82v-jwr5-mffw | npm | next | >=15.0.0 <15.2.3 | 15.2.3 |
| GHSA-f82v-jwr5-mffw | npm | next | >=12.0.0 <12.3.5 | 12.3.5 |
References
- https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
- https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
- https://github.com/vercel/next.js/releases/tag/v12.3.5
- https://github.com/vercel/next.js/releases/tag/v13.5.9
- https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw