Packages / next / Security

CriticalVulnerabilityGHSA-f82v-jwr5-mffwCVE-2025-29927Published 21 Mar 2025

Authorization Bypass in Next.js Middleware

Affected releases · next

  • 15.x15.0.0 – 15.2.2Fixed in 15.2.3
  • 14.x14.0.0 – 14.2.24Fixed in 14.2.25
  • 13.x13.0.0 – 13.5.8Fixed in 13.5.9
  • 12.x12.0.0 – 12.3.4Fixed in 12.3.5

On 15.x, the newest line:

npm install next@15.2.3
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Affected

    15.0.0 – 15.2.2

    25 releases

  2. Fixed

    15.2.3 – 15.5.28

    57 releases

14.x

  1. Affected

    14.0.0 – 14.2.24

    35 releases

  2. Fixed

    14.2.25 – 14.2.35

    11 releases

13.x

  1. Affected

    13.0.0 – 13.5.8

    53 releases

  2. Fixed

    13.5.9 – 13.5.11

    3 releases

12.x

  1. Affected

    12.0.0 – 12.3.4

    30 releases

  2. Fixed

    12.3.5 – 12.3.7

    3 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

  • For Next.js 15.x, this issue is fixed in 15.2.3

  • For Next.js 14.x, this issue is fixed in 14.2.25

  • For Next.js 13.x, this issue is fixed in 13.5.9

  • For Next.js 12.x, this issue is fixed in 12.3.5

  • For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

  • Allam Rachid (zhero;)

  • Allam Yasser (inzo_)