InfoSecBulletin Cybersecurity for mankind
Next.js, a widely used React framework for building full-stack web applications, has fixed a serious security vulnerability. Used by many large companies, Next.js facilitates rapid development with advanced React features and Rust-based JavaScript tools. A recent security advisory has highlighted a critical authorization bypass issue that requires urgent action from developers.
The CVE-2025-29927 advisory, rated 9.1 on the CVSS scale, reveals a serious flaw in Next.js middleware. It states that authorization checks in middleware can be bypassed, allowing attackers to access protected resources in affected applications.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Middleware in Next.js intercepts requests before they reach the application’s routes. It’s often used for authorization to ensure that only authenticated users can access certain parts of the app. However, a newly discovered vulnerability allows attackers to bypass these checks, risking data breaches, unauthorized actions, and service disruptions.
The Next.js team quickly released patched versions to fix CVE-2025-29927. The security advisory clearly states the necessary updates:
For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
If you’re using either of these major versions, updating to the mentioned version is the most important step to fix this vulnerability.
If you’re using older versions of Next.js (11.1.4 to 13.5.6), applying the latest patches may be difficult. The advisory suggests blocking requests with the x-middleware-subrequest header to protect your application, as this header is essential for exploiting the vulnerability. However, be aware that this workaround may affect some features, and upgrading to a patched version should be the priority.
