Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2025-29927 is a vulnerability classified as Improper Authorization, affecting next.js (affected versions: >= 11.1.4, < 12.3.5, >= 14.0.0, < 14.2.25, and other affected versions). This vulnerability is rated Critical, with a CVSS score of 9.1. Current sources do not report this vulnerability as exploited.
Analyzing data...
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
