New Next.js Middleware Vulnerability – How Bad Is It?

A critical security flaw has been identified in Next.js, a widely-used React framework. This vulnerability, known as CVE-2025-29927, allows attackers to bypass middleware-based authorization checks by exploiting the x-middleware-subrequest header. This means unauthorized users could potentially access protected routes without proper validation.

Middleware in Next.js acts as a gatekeeper, performing essential tasks like authentication before requests reach their destinations. If your application's security relies solely on middleware, exploiting this vulnerability could grant attackers access to sensitive areas. However, if you've implemented additional security measures at the page or API route level, unauthorized users might bypass the middleware only to encounter another layer of defense, resulting in access to a page without sensitive data.

My opinion about this is that the severity of this vulnerability entirely depends on how your application is structured. If you depend purely on middleware for authentication, this could be a major security risk. But if your app has proper backend validation and doesn’t expose sensitive data at the page level, an attacker might bypass the middleware only to find themselves staring at a blank page. This is why a layered security approach is crucial—middleware alone should never be your only defense.

The Next.js team has addressed this issue by releasing patched versions: 12.3.5, 13.5.9, 14.2.25, and 15.2.3. It's strongly recommended to update your applications to these versions promptly. If updating isn't feasible immediately, consider configuring your server or load balancer to block external requests containing the x-middleware-subrequest header as a temporary measure.

This incident serves as a reminder that security is never just a one-step solution. Regularly updating dependencies and implementing proper backend checks will always be key to protecting your applications and users.