Next.js middleware can be bypassed (CVE-2025-29927)
Scan rule · RSC-SEC-154
- Security
- Severity: High
- CWE-285
- OWASP A06-2021
Combines the installed Next.js version from the lock file with the context in the repository: is there a middleware.ts with authentication, and is the app self-hosted (Docker, standalone build, Fly, Render, Railway) or on Vercel/Netlify?
Why this matters
With CVE-2025-29927, a single request header makes Next.js skip the middleware. Anyone who checks authentication there — the standard pattern for Supabase, Auth.js and Clerk — has pages that are reachable without logging in.
The version alone says little, though: on Vercel and Netlify the header never reached the app, and middleware without authentication has nothing to bypass. The rule therefore evaluates version, middleware and hosting together and names all three in the evidence.
Check it yourself: the Next.js version is in the lock file; middleware.ts shows whether the middleware carries authentication. If the app is self-hosted, a proxy rule dropping the header helps until the update.
Scan tier
- Repo access (deep scan)
How to fix it
Raise Next.js to 12.3.5, 13.5.9, 14.2.25 or 15.2.3 or newer; until then drop the `x-middleware-subrequest` header at the proxy and check authentication in the pages as well.