Summary
CVE-2025-29927 affects some self-hosted applications that use Next.js Middleware for authorization. An attacker can craft an internal request header that makes the framework treat Middleware as already executed and skip the relevant logic. Protected routes may become directly accessible when access control exists only in Middleware.
This report focuses on defensive triage: identify the deployment model, determine whether Middleware is the only authorization boundary, and upgrade to an officially patched release.
Root cause
Next.js uses an internal request header to track recursive Middleware calls. Affected versions did not sufficiently isolate this internal state at the external trust boundary, allowing a client to supply information that should have been maintained exclusively by the framework.
The core issue is not merely a controllable header. An internal control signal crossed an untrusted input boundary. When an application relies on Middleware as its only authorization layer, downstream routes have no second check.
Exposure conditions
Risk generally requires all of the following conditions:
- The application runs an affected Next.js version.
- Middleware performs authentication or authorization.
- The target route does not independently enforce permissions.
- The deployment path does not remove the internal request header.
Static exports and hosting platforms that mitigate the attack at the edge should be evaluated separately against the vendor advisory.
Mitigation and remediation
- Upgrade to a patched release for the relevant Next.js major version.
- If immediate patching is impossible, remove externally supplied
x-middleware-subrequestheaders at the reverse proxy or load balancer. - Enforce critical permissions again at the data-access or business-logic layer.
- After upgrading, retest unauthenticated, low-privilege, and direct-route access.