CVE-2025-29927

Think of Next.js middleware like the “bouncer” at the door to certain pages in your app. This bug lets a stranger walk past the bouncer without showing the right permission, so they may reach areas you meant to keep private. The practical risk is that protected content—like customer data or admin features—could be accessed.

This matters if you run a Next.js application that relies on middleware to protect routes (for example, admin pages, user-only dashboards, or any protected API endpoints). You should treat it as a risk even without any special user action because the attack is remote and does not require authentication. Fixing is especially important once the vulnerable middleware logic is reachable from the internet—reachability in default configuration is not confirmed in the findings, so you should assume you may be exposed if your app’s middleware-protected routes can be reached publicly.

This is RED because a remote, unauthenticated attacker can bypass authorization checks, and there is a public proof-of-concept available. The fixes exist (Next.js 12.3.5 and next 13.5.9), and the risk is not theoretical—attackers can target protected resources directly. Treat this as an urgent upgrade priority on your next maintenance window, or sooner if you have internet-facing protected routes.

1. Confirm what you run

• Look at your repo’s package.json to identify the installed next / Next.js version.
• Also check the deployed environment (the version used in your production build).

2. Determine whether you’re affected

• If your app uses next earlier than 13.5.9, it’s covered by the “next → fixed in 13.5.9” remediation.
• If your app uses Next.js earlier than 12.3.5, it’s covered by the “next.js → fixed in 12.3.5” remediation.

3. Upgrade to the fixed versions

• Upgrade dependencies to the fixed versions (see exact install steps below).
• Re-run your build and redeploy the application.

4. Validate the fix (important)

• Manually test protected routes that depend on middleware authorization:
  • Try accessing them with no login/session.
  • Verify you get the expected denial/redirect behavior.
• If you have automated tests, add/ensure a test that requests a protected route without authentication and expects denial.

5. If you can’t patch immediately (temporary containment)

• Reduce exposure while planning the upgrade: ensure only the necessary endpoints are reachable from the internet.
• If you can apply temporary routing controls (e.g., firewall/WAF rules) to block unauthenticated access to the affected protected paths, do so until the fixed version is deployed.
• Do not rely on obscurity; authorization must come from the middleware behavior after upgrading.

6. What to monitor after updating

• Review server logs for unusual unauthenticated requests to middleware-protected endpoints.
• Confirm there are no repeat access patterns consistent with authorization bypass attempts.

CISA KEV: Not listed in the provided findings, so prioritize based on the fixed versions and the presence of a public proof-of-concept.

Severity: Critical (as indicated by the provided CVSS 9.1).

Mechanism/weakness: Authorization bypass involving Next.js middleware (CWE-285: Improper Authorization; CWE-863: Incorrect Authorization/Access Control).

Attack requirements: Remote and unauthenticated (no login required, no user interaction).

Impact: Bypasses middleware authorization checks, enabling access to resources intended to be protected. Availability impact is not indicated; the primary risk is confidentiality/integrity via unintended access.

Exploitation status: Public proof-of-concept exists (6 known) and press attention has resurfaced for research purposes; no dated KEV/news exploitation claim is provided in the findings.

Likelihood signal: A very high EPSS prediction is provided in the findings, with a rising trend; however, KEV is not listed, so real-world confirmation is not asserted beyond the PoC.

Fixes:

• next fixed in 13.5.9
• Next.js fixed in 12.3.5

KEV meaning here: KEV would indicate CISA-validated exploitation; it is not listed in the findings, so it does not provide additional confirmation.