Skip to content
fr Sign in
9.1 Critical

CVE-2025-29927 Next.js is a React framework for building full-stack web applications

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Affected products and versions

Product Affected versions Fixed in
next.js 15.0 15.0.0 → < 15.2.3 15.2.3
next.js 14.0 14.0.0 → < 14.2.25 14.2.25
next.js 13.0 13.0.0 → < 13.5.9 13.5.9
next.js 11.1 11.1.4 → < 12.3.5 12.3.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of next.js

The 57 CVEs of next.js →
CVE-2026-94482 Next.js is a React framework for building full-stack web applications 8.2 High CVE-2026-94484 Next.js is a React framework for building full-stack web applications 6.3 Medium CVE-2026-94485 Next.js is a React framework for building full-stack web applications 6.3 Medium CVE-2026-94483 Next.js is a React framework for building full-stack web applications 8.3 High
Track this CVE