Next.js Security Snafu: Middleware Auth Checks Left Wide Open!
Next.js vulnerability alert: middleware auth checks can be bypassed! Next.js version 15.2.3 released to fix CVE-2025-29927. Users should update immediately to avoid unauthorized access risks.
Hot Take:
In the latest episode of “Your Favorite Framework is a Security Sieve,” Next.js takes center stage with a flaw so critical it makes the Great Wall of China look like a picket fence. Developers, brace yourselves—it’s time to patch faster than you can say CVE-2025-29927!
Key Points:
- Next.js framework vulnerability CVE-2025-29927 has a CVSS score of 9.1.
- Critical flaw allows bypassing of authorization checks in middleware.
- Patch released for versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
- Cybersecurity firm JFrog warns against middleware reliance without additional checks.
- Workaround involves blocking external requests with x-middleware-subrequest header.
Already a member? Log in here