Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. next
  4. ›
  5. CVE-2025-29927

CVE-2025-29927: Authorization Bypass in Next.js Middleware

March 21, 2025 (updated March 28, 2025)

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

References

  • github.com/advisories/GHSA-f82v-jwr5-mffw
  • github.com/vercel/next.js
  • github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
  • github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
  • github.com/vercel/next.js/releases/tag/v12.3.5
  • github.com/vercel/next.js/releases/tag/v13.5.9
  • github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
  • nvd.nist.gov/vuln/detail/CVE-2025-29927
  • security.netapp.com/advisory/ntap-20250328-0002
  • vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware

Code Behaviors & Features

Detect and mitigate CVE-2025-29927 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 11.1.4 before 12.3.5, all versions starting from 13.0.0 before 13.5.9, all versions starting from 14.0.0 before 14.2.25, all versions starting from 15.0.0 before 15.2.3

Fixed versions

  • 13.5.9
  • 14.2.25
  • 15.2.3
  • 12.3.5

Solution

Upgrade to versions 12.3.5, 13.5.9, 14.2.25, 15.2.3 or above.

Impact 9.1 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-285: Improper Authorization

Source file

npm/next/CVE-2025-29927.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 00:15:13 +0000.