InfoSecBulletin Cybersecurity for mankind
Next.js, a widely used React framework for building full-stack web applications, has fixed a serious security vulnerability. Used by many large companies, Next.js facilitates rapid development with advanced React features and Rust-based JavaScript tools. A recent security advisory has highlighted a critical authorization bypass issue that requires urgent action from developers.
The CVE-2025-29927 advisory, rated 9.1 on the CVSS scale, reveals a serious flaw in Next.js middleware. It states that authorization checks in middleware can be bypassed, allowing attackers to access protected resources in affected applications.
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
Russian zero-day seller to offer up to $4 million for Telegram exploits
Middleware in Next.js intercepts requests before they reach the application’s routes. It’s often used for authorization to ensure that only authenticated users can access certain parts of the app. However, a newly discovered vulnerability allows attackers to bypass these checks, risking data breaches, unauthorized actions, and service disruptions.
The Next.js team quickly released patched versions to fix CVE-2025-29927. The security advisory clearly states the necessary updates:
For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
If you’re using either of these major versions, updating to the mentioned version is the most important step to fix this vulnerability.
If you’re using older versions of Next.js (11.1.4 to 13.5.6), applying the latest patches may be difficult. The advisory suggests blocking requests with the x-middleware-subrequest header to protect your application, as this header is essential for exploiting the vulnerability. However, be aware that this workaround may affect some features, and upgrading to a patched version should be the priority.
