In Next.js, middleware components run before a request hits an application routing system and serve purposes like authentication, authorization, logging, error handling, redirecting users, applying geo-blocking or rate limits. If it detects the 'x-middleware-subrequest' header, with a specific value, the entire middleware execution chain is bypassed and the request is forwarded to its destination. The flaw, tracked as CVE-2025-29927, enables attackers to send requests that reach destination paths without going through critical security checks. A critical severity vulnerability has been discovered in the Next.js open-source web development framework, potentially allowing attackers to bypass authorization checks. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. To prevent infinite loops where middleware re-triggers itself, Next.js uses a header called 'x-middleware-subrequest' that dictates if middleware functions should be applied or not. The vulnerability impacts all Next.js versions before 15.2.3, 14.2.25, 13.5.9. and 12.3.5. Users are recommended to upgrade to newer revisions as soon as possible, since technical details for exploiting the security issue are public. Also affected are environments where middleware is used for authorization or security checks and there is no validation later in the application. It is used for building full-stack web apps and includes middleware components for authentication and authorization. An attacker can manually send a request that includes the header with a correct value and thus bypass protection mechanisms. If patching is not possible at the time, the recommendation is to block external user requests that include the 'x-middleware-subrequest header'. Next.js' security bulletin clarifies that CVE-2025-29927 impacts only self-hosted versions that use 'next start' with 'output: standalone'.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 24 Mar 2025 16:20:06 +0000