Next.js middleware bypass checker (CVE-2025-29927)

Next.js uses an internal header, x-middleware-subrequest, to stop middleware from calling itself in a loop. Before the fix, a request from outside could set that header and the server would skip middleware entirely, including any authorization check done there (GHSA-f82v-jwr5-mffw).

It was reported on 27 February 2025 and disclosed on 21 March 2025. Fixes shipped in 15.2.3 and 14.2.25, then were backported to 13.5.9 and 12.3.5 (Vercel’s post-mortem). The advisory has no patched 11.x release and points 11.x users to the workaround.

• next

  Affected

  12.x before 12.3.5, 13.x before 13.5.9, 14.x before 14.2.25, 15.x before 15.2.3

  Fixed or safe

  12.3.5, 13.5.9, 14.2.25, 15.2.3 (11.x: workaround only)

Affected: self-hosted apps that run next start or output: 'standalone' and rely on middleware for authorization.

Not affected, according to Vercel: apps hosted on Vercel or Netlify, apps on Cloudflare Workers, and static exports, which have no Next.js server to bypass.

1. 1Upgrade next to 15.2.3, 14.2.25, 13.5.9 or 12.3.5 or later in your line. The check above shows the newest release that also fixes later advisories.
2. 2If you can’t upgrade yet, drop the x-middleware-subrequest header from external requests at your proxy or load balancer before they reach Next.js.
3. 3Don’t rely on middleware alone for access control: check authorization again where the data is read (route handlers, server actions, the data layer), as Vercel recommends.

• Next.js advisory GHSA-f82v-jwr5-mffw
• Vercel: post-mortem on the Next.js middleware bypass
• CVE-2025-29927 on OSV.dev