TechPrufer
Sign inGet started

Blogs›Vercel›Next.js Middleware Security

Next.js Middleware Security

Next.js Middleware Security

1
posts
2025

Vercel has addressed a critical vulnerability (CVE-2025-29927) in Next.js Middleware that allowed for bypasses. The vulnerability stemmed from an internal `x-middleware-subrequest` header used to prevent recursion, which could be manipulated. Patches have been released for Next.js 15.x, 14.x, 13.5.9, and 12.3.5. Vercel's own platform was incidentally invulnerable due to its decoupled routing system. Next steps include improving partner communication, streamlining security reporting, enhancing internal processes, formalizing an LTS policy, documenting internal headers, and further investigating Middleware security.

2025

Postmortem on Next.js Middleware bypass

3/25/2025

This post details a critical vulnerability (CVE-2025-29927) in Next.js Middleware, explaining the timeline of its discovery, investigation, and patching. It provides a technical analysis of how the `x-middleware-subrequest` header could be exploited to bypass Middleware execution and discusses why Vercel's platform was not affected. The post also outlines next steps for improving security processes, partner communication, and the Next.js LTS policy.