Critical flaw in Next.js lets hackers bypass authorization

Critical security flaw in Next.js could spell big trouble for JavaScript users

Users told to ensure to apply the Next.js patch as soon as possible.

Researchers raise alarm about critical Next.js vulnerability

Researchers warn that attackers could exploit a recently discovered critical vulnerability in the open-source JavaScript framework Next.js to bypass authorization in middleware and gain access to targeted systems. Vercel, the San Francisco-based company that created and maintains Next.js, released a patch for CVE-2025-29927 in Next.js 15.2.3 on March 18 and published a security advisory on March 21. Researchers Allam Rachid and Allam Yasser disc…

NextJS security flaw: Critical 9.1 vulnerability lets attackers bypass authentication via middleware - Tech Startups

Security researchers have uncovered a major flaw in the Next.js React framework that makes it possible to bypass middleware-based access control. The discovery came last Friday—right after an unlucky developer pushed to production (on a Friday, of all days). Next.js […] The post NextJS security flaw: Critical 9.1 vulnerability lets attackers bypass authentication via middleware first appeared on Tech Startups.

Critical flaw in Next.js lets hackers bypass authorization

A critical severity vulnerability has been discovered in the Next.js open-source web development framework, potentially allowing attackers to bypass authorization checks.

Next.js Middleware Flaw Lets Attackers Bypass Authorization

Researchers have uncovered a critical vulnerability (CVE-2025-29927) in Next.js middleware, allowing authorization bypass. Learn about the exploit and fixes.