TechPrufer
Get started
Vercel
Vercel logoVercel · Feature trail

Next.js Middleware Security

1 post · Mar 2025

What this trail covers

Vercel has addressed a critical vulnerability (CVE-2025-29927) in Next.js Middleware that allowed for bypasses. The vulnerability stemmed from an internal `x-middleware-subrequest` header used to prevent recursion, which could be manipulated. Patches have been released for Next.js 15.x, 14.x, 13.5.9, and 12.3.5. Vercel's own platform was incidentally invulnerable due to its decoupled routing system. Next steps include improving partner communication, streamlining security reporting, enhancing internal processes for vulnerability response, and establishing a partner mailing list.

All Vercel trails
  1. Postmortem on Next.js Middleware bypassThis post details a post-incident analysis of CVE-2025-29927, a critical vulnerability in Next.js Middleware. It explains the timeline of disclosure, investigation, and patching, highlighting that Vercel's platform was incidentally invulnerable due to its decoupled routing system. The technical analysis describes how the vulnerability exploited an internal `x-middleware-subrequest` header to bypass Middleware execution. Next steps include improving partner communication, streamlining security reporting, enhancing internal response processes, and establishing a partner mailing list.