Published 2 days ago • loading... • Updated 22 hours ago

Critical flaw in Next.js lets hackers bypass authorization

A critical vulnerability in Next.js allows attackers to bypass authorization checks, tracked as CVE-2025-29927, affecting self-hosted versions using 'next start' with 'output: standalone' according to Next.js' security bulletin.
The vulnerability enables an attacker to send requests bypassing critical security checks, impacting all Next.js versions before 15.2.3, as stated by researchers Allam Rachid and Allam Yasser.
Vercel released a patch for the vulnerability on March 18, 2025, and published a security advisory on March 21, 2025, addressing this critical vulnerability.
Concerns linger regarding Vercel's response and communication about the vulnerability, as indicated by CISO Ty Sbano, who noted, 'There has been understandable concern that our communication with partners during this incident did not meet our typical standards.

Insights by Ground AI

Does this summary seem wrong?

15 Articles

All

Left

Center

Right

CyberScoop

Center

Researchers raise alarm about critical Next.js vulnerability

Researchers warn that attackers could exploit a recently discovered critical vulnerability in the open-source JavaScript framework Next.js to bypass authorization in middleware and gain access to targeted systems. Vercel, the San Francisco-based company that created and maintains Next.js, released a patch for CVE-2025-29927 in Next.js 15.2.3 on March 18 and published a security advisory on March 21. Researchers Allam Rachid and Allam Yasser disc…

2 days ago

Read Full Article

Startups News | Tech News

Lean Right

NextJS security flaw: Critical 9.1 vulnerability lets attackers bypass authentication via middleware - Tech Startups

Security researchers have uncovered a major flaw in the Next.js React framework that makes it possible to bypass middleware-based access control. The discovery came last Friday—right after an unlucky developer pushed to production (on a Friday, of all days). Next.js […] The post NextJS security flaw: Critical 9.1 vulnerability lets attackers bypass authentication via middleware first appeared on Tech Startups.

2 days ago

Read Full Article

BleepingComputer

Center

Critical flaw in Next.js lets hackers bypass authorization

A critical severity vulnerability has been discovered in the Next.js open-source web development framework, potentially allowing attackers to bypass authorization checks.

2 days ago

Read Full Article

Traefik Labs: Makes Networking Boring

Security Alert: How Attackers Can Bypass Next.js Middleware With a Single HTTP Header

The Critical Vulnerability Every Next.js Developer Should Know AboutDid you know that a simple HTTP header manipulation could completely bypass your authentication and authorization systems in Next.js applications? Recently, a critical vulnerability (CVE-2025-29927) was disclosed in the popular Next.js framework, allowing attackers to circumvent middleware execution—including security checks—by leveraging an internal header.Understanding Next.js…

22 hours ago

Read Full Article

Kali Linux Tutorials

CVE-2025-29927 : Next.js Middleware Authorization Bypass

A critical vulnerability, CVE-2025-29927, has been identified in Next.js, a React-based web framework by Vercel. This flaw allows attackers to bypass middleware-based authorization checks by exploiting the x-middleware-subrequest header. Middleware in Next.js is widely used for tasks such as path rewriting, server-side redirects, security headers (e.g., CSP), and access control. The vulnerability affects versions 11.1.4 […]

1 day ago

Read Full Article