Next.js Security Flaw: Hackers Find “Universal Key” to Bypass Authorization!
A critical vulnerability in the Next.js framework, CVE-2025-29927, lets attackers bypass authorization checks with a magic header trick. This flaw affects all self-hosted versions before 15.2.3. Just think of it as a VIP pass to your web app’s backstage, but for hackers. Update now or risk being part of the “Unauthorized Access Club.”
Hot Take:
Who knew that a tiny little header could pack such a punch? In the wonderful world of Next.js, forget about the secret key under the doormat—it’s all about that ‘x-middleware-subrequest’ header. Looks like authorization just got bypassed faster than your mom on a Black Friday sale!
Key Points:
- CVE-2025-29927 allows attackers to bypass authorization in Next.js.
- Vulnerability affects all versions before 15.2.3, 14.2.25, 13.5.9, and 12.3.5.
- The flaw involves manipulating the ‘x-middleware-subrequest’ header.
- Self-hosted Next.js instances running ‘next start’ with ‘output: standalone’ are affected.
- Update to the latest version or block requests with the specific header to mitigate risk.
Already a member? Log in here