Latest Next.js vulnerabilities #
On March 22nd, 2025, Next.js disclosed an authentication bypass vulnerability in the middleware layer. Exploitation is trivial and can be achieved by sending an extra HTTP header. For specifics, please see the research paper.
- CVE-2025-29927 is rated critical with a CVSSv3 base score of 9.1.
What is the impact? #
Successful exploitation of this vulnerability would allow a remote attacker to bypass security checks implemented in the middleware layer, including many forms of authentication.
Are updates or workarounds available? #
Next.js recommends that customers upgrade to 15.2.3 or 14.2.25. For users that cannot upgrade they recommend filtering the `x-middleware-subrequest` header from requests before they reach the application (case insensitive).
How to find Next.js installations with runZero #
From the Service Inventory, use the following query to locate assets running any version of Next.js
_asset.protocol:http AND protocol:http AND (has:http.head.xPoweredBy AND http.head.xPoweredBy:="Next.js")
A slower, but more comprehensive Service Inventory query:
_asset.protocol:http AND protocol:http AND (
http.head.xPoweredBy:="Next.js" OR
http.head.vary:"Next-Router" OR
has:http.head.xNextjsCache OR
http.body:"/_next/static/"
)
