vercel Next.js up to 14.2.24/15.2.2 Header x-middleware-subrequest improper authorization

Summaryinfo

A vulnerability, which was classified as critical, was found in vercel Next.js up to 14.2.24/15.2.2. Affected is an unknown function of the component Header Handler. Such manipulation of the argument x-middleware-subrequest leads to improper authorization. This vulnerability is documented as CVE-2025-29927. The attack can be executed remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in vercel Next.js up to 14.2.24/15.2.2 and classified as critical. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument x-middleware-subrequest with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Next.js is a React framework for building full-stack web applications. Prior to 14.2.25 and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 14.2.25 and 15.2.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-29927 since 03/12/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1548.002.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 14.2.25 or 15.2.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52124) and CERT Bund (WID-SEC-2025-0627). Once again VulDB remains the best source for vulnerability data.

Affected

• Vercel Next.js

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• Next.js

Version

• 14.2.0
• 14.2.1
• 14.2.2
• 14.2.3
• 14.2.4
• 14.2.5
• 14.2.6
• 14.2.7
• 14.2.8
• 14.2.9
• 14.2.10
• 14.2.11
• 14.2.12
• 14.2.13
• 14.2.14
• 14.2.15
• 14.2.16
• 14.2.17
• 14.2.18
• 14.2.19
• 14.2.20
• 14.2.21
• 14.2.22
• 14.2.23
• 14.2.24
• 15.2.0
• 15.2.1
• 15.2.2

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion