CVE-2025-29927:
Authorization Bypass in Next.js Middleware
9.1
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
3/21/2025
Updated
3/24/2025
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 13.0.0, < 13.5.9 | 13.5.9 |
| next | npm | >= 14.0.0, < 14.2.25 | 14.2.25 |
| next | npm | >= 15.0.0, < 15.2.3 | 15.2.3 |
| next | npm | >= 11.1.4, < 12.3.5 | 12.3.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis focused on the modified functions in the patches that directly relate to the handling of the 'x-middleware-subrequest' header. The 'initialize' function is critical as it sets up the routing and can allow unauthorized access if not properly secured. The 'filterInternalHeaders' function is essential for filtering out potentially malicious headers, and the 'context.ts' function is involved in setting headers that could be exploited. Each function was linked to specific changes in the patches that indicate their role in the vulnerability.
Vulnerable functions
initializepackages/next/src/server/lib/router-server.ts
This function initializes the router and handles incoming requests. The vulnerability arises from the fact that it does not properly validate the 'x-middleware-subrequest' header, allowing unauthorized access to routes.
filterInternalHeaderspackages/next/src/server/lib/server-ipc/utils.ts
This function processes headers and is critical in filtering out the 'x-middleware-subrequest' header. If this header is not properly filtered, it can lead to unauthorized access by bypassing middleware checks.
context.tspackages/next/src/server/web/sandbox/context.ts
This function sets the 'x-middleware-subrequest-id' header, which is used to track middleware subrequests. If this header is manipulated, it can lead to bypassing authorization checks.