Datadog Security Labs · Crawled Jul 25, 2026
Understanding CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability | Datadog Security Labs
33 IoCs 1 CVEs
Read original article ↗
AI Summary
CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware that allows attackers to skip security checks by exploiting improper handling of the internal 'x-middleware-subrequest' header. Exploitation involves sending a crafted HTTP request with this header to bypass middleware protections, potentially exposing administrative routes and sensitive content. The vulnerability affects self-hosted Next.js applications using vulnerable versions prior to specific patched releases, with immediate remediation advised through upgrading or implementing temporary mitigations.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 33 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 134[.]122[.]111[.]207 | Details → |
| IP | 139[.]162[.]130[.]199 | Details → |
| IP | 139[.]162[.]154[.]240 | Details → |
| IP | 139[.]162[.]171[.]103 | Details → |
| IP | 139[.]162[.]172[.]244 | Details → |
| IP | 139[.]162[.]189[.]169 | Details → |
| IP | 172[.]104[.]149[.]38 | Details → |
| IP | 172[.]104[.]153[.]103 | Details → |
| IP | 172[.]104[.]153[.]129 | Details → |
| IP | 172[.]104[.]153[.]227 | Details → |
| IP | 172[.]104[.]153[.]232 | Details → |
| IP | 172[.]104[.]153[.]235 | Details → |
| IP | 172[.]104[.]153[.]246 | Details → |
| IP | 172[.]104[.]235[.]170 | Details → |
| IP | 172[.]104[.]235[.]194 | Details → |
| IP | 172[.]104[.]235[.]232 | Details → |
| IP | 172[.]104[.]235[.]237 | Details → |
| IP | 172[.]104[.]235[.]59 | Details → |
| IP | 172[.]104[.]245[.]212 | Details → |
| IP | 172[.]105[.]70[.]14 | Details → |
| IP | 172[.]105[.]70[.]162 | Details → |
| IP | 172[.]105[.]70[.]18 | Details → |
| IP | 172[.]105[.]70[.]216 | Details → |
| IP | 172[.]105[.]75[.]116 | Details → |
| IP | 172[.]105[.]75[.]218 | Details → |
| IP | 172[.]105[.]75[.]235 | Details → |
| IP | 172[.]105[.]75[.]95 | Details → |
| IP | 192[.]46[.]237[.]147 | Details → |
| IP | 207[.]180[.]202[.]75 | Details → |
| IP | 45[.]79[.]249[.]191 | Details → |
| IP | 45[.]79[.]249[.]36 | Details → |
| IP | 85[.]90[.]244[.]219 | Details → |
| IP | 85[.]90[.]244[.]8 | Details → |