CVE

CVE-2025-29927

View on NVD ↗

Authorization Bypass in Next.js Middleware

Exploitation IoCs 33

IP 134[.]122[.]111[.]207
IP 139[.]162[.]130[.]199
IP 139[.]162[.]154[.]240
IP 139[.]162[.]171[.]103
IP 139[.]162[.]172[.]244
IP 139[.]162[.]189[.]169
IP 172[.]104[.]149[.]38
IP 172[.]104[.]153[.]103
IP 172[.]104[.]153[.]129
IP 172[.]104[.]153[.]227
IP 172[.]104[.]153[.]232
IP 172[.]104[.]153[.]235
IP 172[.]104[.]153[.]246
IP 172[.]104[.]235[.]170
IP 172[.]104[.]235[.]194
IP 172[.]104[.]235[.]232
IP 172[.]104[.]235[.]237
IP 172[.]104[.]235[.]59
IP 172[.]104[.]245[.]212
IP 172[.]105[.]70[.]14
IP 172[.]105[.]70[.]162
IP 172[.]105[.]70[.]18
IP 172[.]105[.]70[.]216
IP 172[.]105[.]75[.]116
IP 172[.]105[.]75[.]218
IP 172[.]105[.]75[.]235
IP 172[.]105[.]75[.]95
IP 192[.]46[.]237[.]147
IP 207[.]180[.]202[.]75
IP 45[.]79[.]249[.]191
IP 45[.]79[.]249[.]36
IP 85[.]90[.]244[.]219
IP 85[.]90[.]244[.]8

MITRE ATT&CK TTPs 1

T1190
Exploit Public-Facing Application
Initial Access

Source Articles

Understanding CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability | Datadog Security Labs
CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware that allows attackers to skip security checks by exploiting improper handling of the internal 'x-middleware-subrequest' header. Exploitation involves sending a crafted HTTP request with this header to bypass middleware protections, potentially exposing administrative routes and sensitive content. The vulnerability affects self-hosted Next.js applications using vulnerable versions prior to specific patched releases, with immediate remediation advised through upgrading or implementing temporary mitigations.
Datadog Security Labs
Next.js moves to scheduled security releases
Next.js is transitioning to a scheduled security release model to address vulnerabilities in a predictable and coordinated manner, replacing ad-hoc patching. This change follows high-severity incidents like React2Shell (CVE-2025-55182), a critical remote code execution flaw in React Server Components that was widely exploited. The new program enables advance notice of patches, allowing organizations time to plan upgrades and implement mitigations. Vercel cites increasing vulnerability discovery rates due to AI-assisted tools as a driver for more frequent and structured releases.
socket-dev