InfoSecBulletin Cybersecurity for mankind
Next.js, a widely used React framework for building full-stack web applications, has fixed a serious security vulnerability. Used by many large companies, Next.js facilitates rapid development with advanced React features and Rust-based JavaScript tools. A recent security advisory has highlighted a critical authorization bypass issue that requires urgent action from developers.
The CVE-2025-29927 advisory, rated 9.1 on the CVSS scale, reveals a serious flaw in Next.js middleware. It states that authorization checks in middleware can be bypassed, allowing attackers to access protected resources in affected applications.
First couple “Rosie” to conceive using AI tech “STAR” successfully
Scattered Spider Actively Attacking Aviation and Transportation: FBI
Russia’s restrictions on Cloudflare making websites inaccessible
61 million Verizon records allegedly posted online for sale
Cyber Expert ‘Rene Joshilda’ Arrested for Bomb Hoaxes
Critical RCE Flaws in Cisco ISE and ISE-PIC Allow to Gain Root Access
CISA Warns of FortiOS Hard-Coded Credentials Vulns
5 vendors’ printer totaling 748 models affected: Rapid7
Citrix Released Emergency Patches for Actively Exploited CVE-2025-6543
SonicWall warns of a trojanized NetExtender stealing VPN logins
Middleware in Next.js intercepts requests before they reach the application’s routes. It’s often used for authorization to ensure that only authenticated users can access certain parts of the app. However, a newly discovered vulnerability allows attackers to bypass these checks, risking data breaches, unauthorized actions, and service disruptions.
The Next.js team quickly released patched versions to fix CVE-2025-29927. The security advisory clearly states the necessary updates:
For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
If you’re using either of these major versions, updating to the mentioned version is the most important step to fix this vulnerability.
If you’re using older versions of Next.js (11.1.4 to 13.5.6), applying the latest patches may be difficult. The advisory suggests blocking requests with the x-middleware-subrequest header to protect your application, as this header is essential for exploiting the vulnerability. However, be aware that this workaround may affect some features, and upgrading to a patched version should be the priority.
