CVE-2025-29927

CVE-2025-29927 is a critical authorization bypass vulnerability affecting Next.js versions 1.11.4 up to 12.3.5, 13.5.9, 14.2.25, and 15.2.3, allowing attackers to circumvent security checks within Next.js middleware. With a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network without authentication, leading to high impact on confidentiality and integrity. Active exploitation has been observed, with exploit code publicly available via Nuclei templates and ExploitDB, and significant community discussion and media coverage highlight its widespread threat. Organizations are strongly advised to patch immediately or implement the recommended mitigation of blocking requests containing the x-middleware-subrequest header.