Aller au contenu
en Se connecter
9.1 Critique

CVE-2025-29927 Next.js is a React framework for building full-stack web applications

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Produits et versions touchés

Produit Versions touchées Corrigé en
next.js 15.0 15.0.0 → < 15.2.3 15.2.3
next.js 14.0 14.0.0 → < 14.2.25 14.2.25
next.js 13.0 13.0.0 → < 13.5.9 13.5.9
next.js 11.1 11.1.4 → < 12.3.5 12.3.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de next.js

Les 57 CVE de next.js →
CVE-2026-94482 Next.js is a React framework for building full-stack web applications 8.2 Élevée CVE-2026-94484 Next.js is a React framework for building full-stack web applications 6.3 Moyenne CVE-2026-94485 Next.js is a React framework for building full-stack web applications 6.3 Moyenne CVE-2026-94483 Next.js is a React framework for building full-stack web applications 8.3 Élevée
Suivre cette CVE