InfoSecBulletin Cybersecurity for mankind
Next.js, a widely used React framework for building full-stack web applications, has fixed a serious security vulnerability. Used by many large companies, Next.js facilitates rapid development with advanced React features and Rust-based JavaScript tools. A recent security advisory has highlighted a critical authorization bypass issue that requires urgent action from developers.
The CVE-2025-29927 advisory, rated 9.1 on the CVSS scale, reveals a serious flaw in Next.js middleware. It states that authorization checks in middleware can be bypassed, allowing attackers to access protected resources in affected applications.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Middleware in Next.js intercepts requests before they reach the application’s routes. It’s often used for authorization to ensure that only authenticated users can access certain parts of the app. However, a newly discovered vulnerability allows attackers to bypass these checks, risking data breaches, unauthorized actions, and service disruptions.
The Next.js team quickly released patched versions to fix CVE-2025-29927. The security advisory clearly states the necessary updates:
For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
If you’re using either of these major versions, updating to the mentioned version is the most important step to fix this vulnerability.
If you’re using older versions of Next.js (11.1.4 to 13.5.6), applying the latest patches may be difficult. The advisory suggests blocking requests with the x-middleware-subrequest header to protect your application, as this header is essential for exploiting the vulnerability. However, be aware that this workaround may affect some features, and upgrading to a patched version should be the priority.
