Next.js Middleware Authentication Bypass Vulnerability (CVE-2025-29927)

Next.js middleware plays a key role in securing applications by enforcing authentication, managing access control, and applying security headers. However, a newly discovered vulnerability, CVE-2025-29927, allows attackers to bypass these protections entirely using a manipulated HTTP header.

Affected Versions

This flaw affects the following versions:

• Next.js prior to 14.2.25

• Next.js prior to 15.2.3

The Core Issue

Next.js prevents infinite middleware loops by tracking executions using the x-middleware-subrequest header. If this header exceeds a defined threshold (MAX_RECURSION_DEPTH, default: 5), middleware execution stops. Attackers can exploit this by manually setting the header, tricking Next.js into skipping security checks.

Vulnerable code example:

const runtime <strong>=</strong> await getRuntimeContext(params)
const subreq <strong>=</strong> params<strong>.</strong>request<strong>.</strong>headers[`x<strong>-</strong>middleware<strong>-</strong>subrequest`]
const subrequests <strong>=</strong> typeof subreq <strong>===</strong> 'string' <strong>?</strong> subreq<strong>.</strong>split(':') <strong>:</strong> []

const MAX_RECURSION_DEPTH <strong>=</strong> 5
const depth <strong>=</strong> subrequests<strong>.</strong>reduce(
  (acc, curr) <strong>=></strong> (curr <strong>===</strong> params<strong>.</strong>name <strong>?</strong> acc <strong>+</strong> 1 <strong>:</strong> acc),
  0
)

<strong>if</strong> (depth <strong>>=</strong> MAX_RECURSION_DEPTH) {
  <strong>return</strong> {
    waitUntil: <strong>Promise.</strong>resolve(),
    response: <strong>new</strong> <strong>runtime.context.Response</strong>(<strong>null</strong>, {
      headers: {
        'x-middleware-next': '1',
      },
    }),
  }
}

By injecting a header like x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware, attackers force Next.js to assume middleware has already executed, leading to a full security bypass.

Real-World Security Risks

This vulnerability enables various high-impact attacks:

1. Authentication Bypass. Attackers can gain unauthorized access to restricted areas such as admin panels or user dashboards.
2. CSP Header Bypass. Attackers can circumvent middleware-enforced security headers, causing these critical protections to disappear.
3. Geographic Restrictions Bypass. Attackers can spoof their location to access content that is restricted by geographic boundaries.

Mitigation Steps

To enhance the security of your application, consider these essential steps:

1. Upgrade to a Patched Version. Ensure your application is secure by upgrading to Next.js versions 15.2.3 or later, or 14.2.25 or later, as these releases have addressed the identified vulnerability.
2. Block Malicious Headers. If an immediate update isn’t feasible, implement a temporary measure by filtering out the x-middleware-subrequest header at the web server level to mitigate potential risks

How Upwind Protects Against This Threat

Upwind’s Runtime Security is designed to detect and flag malicious requests attempting to exploit vulnerabilities.

Our platform offers the following capabilities:

• Live API Traffic Monitoring. Continuously monitors API traffic to detect exploitation attempts.
• AI-based Anomaly Detection. Utilizes advanced AI algorithms to identify abnormal request patterns.
• Real-Time Alerts. Notifies security teams immediately to prevent active attacks.
• Exposure Overview. Offers a detailed overview of resources running vulnerable Next.js versions, enabling teams to quickly evaluate and address potential risks.

Learn More

By leveraging Upwind’s runtime security, organizations gain enhanced visibility into exploitation attempts, allowing them to dynamically protect their applications. To learn more about how Upwind protects against vulnerabilities, schedule a demo.