Critical Next.js Flaw Lets Attackers Bypass Authorization Controls

A newly disclosed critical vulnerability in the Next.js framework, tracked as CVE-2025-29927, enables unauthenticated attackers to bypass middleware-based authorization by abusing the x-middleware-subrequest HTTP header. According to Security Researchers, the flaw arises because Next.js does not adequately distinguish between legitimate internal subrequests and external requests, allowing an attacker to set the header to force the middleware to skip authentication and authorization checks.

This affects all versions that rely on this header to differentiate subrequests, risking exposure of protected routes and administrative interfaces. The exploit works by evaluating the header in middleware and, if a match is found, returning NextResponse[.]next(), thereby bypassing downstream checks.

The article details various version-specific scenarios, including how the header value changes in older and newer middleware file naming conventions, and demonstrates simple request craft scenarios that can grant access to endpoints such as /admin. Patch recommendations emphasise validating the header’s origin and enforcing server-side checks regardless of header presence, alongside continuous monitoring and framework updates to mitigate exploitation.