CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

• CWE-285
• CWE-863

• https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2Patch
• https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48Patch
• https://github.com/vercel/next.js/releases/tag/v12.3.5Release Notes
• https://github.com/vercel/next.js/releases/tag/v13.5.9Release Notes
• https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffwVendor Advisory
• http://www.openwall.com/lists/oss-security/2025/03/23/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2025/03/23/4Mailing List
• https://security.netapp.com/advisory/ntap-20250328-0002/Third Party Advisory

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2992A vulnerability classified as critical was found in Tenda FH…6.9
• CVE-2025-29922kcp is a Kubernetes-like control plane for form-factors and …9.6
• CVE-2025-29923go-redis is the official Redis client library for the Go pro…3.7
• CVE-2025-29924XWiki Platform is a generic wiki platform. Prior to 15.10.14…7.5
• CVE-2025-29925XWiki Platform is a generic wiki platform. Prior to 15.10.14…5.3
• CVE-2025-29926XWiki Platform is a generic wiki platform. Prior to 15.10.15…9.8
• CVE-2025-29928authentik is an open-source identity provider. Prior to vers…8
• CVE-2025-29929Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-2993A vulnerability, which was classified as critical, has been …6.9
• CVE-2025-29930imFAQ is an advanced questions and answers management system…6.9
• CVE-2025-29931A vulnerability has been identified in TeleControl Server Ba…6.3
• CVE-2025-29932In JetBrains GoLand before 2025.1 an XXE during debugging wa…5.3