CVE-2025-29927: Critical Next.js Middleware Authentication Bypass Actively Exploited in the Wild

Overview: A Critical Flaw at the Heart of Next.js Middleware

On March 21, 2025, Vercel — the primary maintainer of the widely used Next.js React framework — issued an emergency security advisory for CVE-2025-29927, a critical-severity vulnerability carrying a CVSS score of 9.1. The flaw resides in the middleware layer of Next.js and enables remote, unauthenticated attackers to bypass all middleware-enforced security checks, including authentication gates, authorization logic, and bot-protection mechanisms.

Security researchers at Allam Rachid (zhero_) and Allam Yasser (inzo_) of the independent research group zhero web security are credited with discovering and responsibly disclosing the vulnerability. Within 48 hours of public disclosure, honeypot infrastructure operated by multiple threat intelligence firms began logging active exploitation attempts across internet-facing Next.js deployments.

Technical Root Cause

Next.js uses a middleware system that intercepts HTTP requests before they reach page routes or API handlers. This middleware is commonly used to enforce session validation, JWT verification, role-based access control, and geographic restrictions. The vulnerability stems from how Next.js internally uses a special request header — x-middleware-subrequest — to track internal subrequest chains and prevent infinite middleware recursion loops.

Researchers discovered that an external attacker can manually inject this header into any inbound HTTP request. When Next.js detects the presence of this header, it interprets the request as an internal subrequest that has already passed through middleware processing, and therefore skips middleware execution entirely. The result is that any route protected solely by middleware logic — including admin panels, API endpoints, and authenticated pages — becomes fully accessible without any credentials or tokens.

"The vulnerability is trivially exploitable. A single crafted HTTP header is sufficient to defeat every middleware-based protection in a Next.js application. There is no authentication, no cryptographic verification, and no rate limiting preventing abuse." — zhero web security disclosure report

Affected Versions

The vulnerability affects a broad range of Next.js versions across both the Pages Router and App Router paradigms:

• Next.js versions below 15.2.3 (all 15.x releases prior to the patch)
• Next.js 14.x — all versions below 14.2.25
• Next.js 13.x and 12.x — older branches confirmed vulnerable; no patches will be issued for end-of-life versions
• Applications using self-hosted Next.js deployments are most at risk; Vercel-hosted applications have an additional platform-level mitigation layer that strips the malicious header at the edge

Given that Next.js is downloaded approximately 9 million times per week via npm, the attack surface is extraordinarily large. Analysts estimate hundreds of thousands of self-hosted production deployments remain unpatched as of this writing.

Active Exploitation and Threat Actor Activity

Threat intelligence firm Shadowserver Foundation confirmed on March 23, 2025 that it is tracking active scanning and exploitation attempts across its global sensor network. Observed attack patterns include:

• Automated scanners probing for exposed /admin, /dashboard, and /api/internal routes using the x-middleware-subrequest header injection technique
• Targeted exploitation of SaaS platforms and fintech applications built on Next.js, with attackers attempting to access privileged API endpoints
• Credential harvesting attempts following successful middleware bypass, targeting session token storage and user data APIs
• At least two threat actor clusters, tentatively categorized as opportunistic financially motivated groups, have incorporated the exploit into automated toolkits

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has not yet added CVE-2025-29927 to its Known Exploited Vulnerabilities (KEV) catalog as of publication, though security researchers expect this designation imminently given confirmed in-the-wild exploitation.

Remediation and Mitigation Guidance

Organizations running Next.js applications should treat this as a critical-priority patch and act immediately. The recommended remediation steps are as follows:

• Upgrade immediately to Next.js 15.2.3 or 14.2.25, which strip the x-middleware-subrequest header from all incoming external requests before middleware processing begins
• If an immediate upgrade is not feasible, deploy a WAF rule or reverse proxy filter (nginx, Cloudflare, AWS CloudFront) to block or strip any inbound request containing the x-middleware-subrequest header
• Audit middleware-dependent security logic: any authentication or authorization enforced exclusively at the middleware layer should be duplicated at the route handler or API layer as a defense-in-depth measure
• Review access logs for historical requests containing the x-middleware-subrequest header originating from external IPs, which may indicate prior exploitation
• Organizations on end-of-life Next.js versions (12.x, 13.x) should urgently prioritize framework upgrades or implement network-layer mitigations, as no backport patches are planned

Broader Security Implications

This vulnerability highlights a systemic risk pattern in modern web frameworks: the dangerous assumption that internal control headers are implicitly trusted without verification of their origin. Security architects designing applications on framework middleware systems should never treat middleware as the sole enforcement boundary for sensitive access controls.

The incident also underscores the speed at which proof-of-concept exploits transition to active mass exploitation. From public disclosure to confirmed in-the-wild attacks took less than 48 hours, reinforcing the importance of pre-patching strategies and runtime security controls that do not rely solely on keeping frameworks up to date.

QuantNest Radar will continue to monitor CVE-2025-29927 for new threat actor activity, indicators of compromise, and any updates to CISA's KEV catalog. Organizations requiring assistance with exposure assessment or emergency patch deployment should engage their incident response teams immediately.