{"id":31407,"date":"2025-03-25T02:23:44","date_gmt":"2025-03-25T02:23:44","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=31407"},"modified":"2026-04-17T18:07:36","modified_gmt":"2026-04-17T18:07:36","slug":"next-js-middleware-permission-bypass-vulnerability-cve-2025-29927","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/next-js-middleware-permission-bypass-vulnerability-cve-2025-29927\/","title":{"rendered":"Next.js Middleware Permission Bypass Vulnerability (CVE-2025-29927)"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS CERT detected that Next.js issued a security announcement and fixed the middleware permission bypass vulnerability (CVE-2025-29927). Because Next.js lacks effective verification of the source of the x-middleware-subrequest header, when configuring to use middleware for authentication and authorization, an unauthenticated attacker can bypass system permission controls by manipulating the x-middleware-subrequest header to access the targeted protected resource. At present, the vulnerability details and PoC have been made public. Relevant users are requested to take measures for protection as soon as possible.<\/p>\n\n\n\n

Next.js is a React-based open source web framework in the Node.js ecosystem, which provides backend development capabilities through the Server Actions function. NSFOCUS has successfully replicated this vulnerability:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n
\"Red<\/a><\/figure>\n\n\n\n

Reference link: https:\/\/github.com\/vercel\/next.js\/security\/advisories\/GHSA-f82v-jwr5-mffw<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected version<\/strong><\/p>\n\n\n\n