CVE-2025-29927: Vercel Next.js broken access control (CVSS 9.1)

Description

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Vercel Next.js≥ 11.1.4 < 12.3.5 · ≥ 13.0.0 < 13.5.9 · ≥ 14.0.0 < 14.2.25 · ≥ 15.0.0 < 15.2.3

Remediation

Fixed in

Vercel Next.js≥ 12.3.5

Patch & vendor advisories

References

https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2Patch
https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48Patch
https://github.com/vercel/next.js/releases/tag/v12.3.5Release Notes
https://github.com/vercel/next.js/releases/tag/v13.5.9Release Notes
https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffwVendor Advisory
https://security.netapp.com/advisory/ntap-20250328-0002/Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/03/23/3Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/03/23/4Mailing List

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-29927 being actively exploited?

CVE-2025-29927 is not in the CISA KEV catalog. Its EPSS exploit probability is 99.2%.

How severe is CVE-2025-29927?

CVE-2025-29927 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 99.2% probability of exploitation.

Which products are affected by CVE-2025-29927?

Affected products include Vercel Next.js.

How do I fix CVE-2025-29927?

Upgrade affected software to a fixed version, for example Vercel Next.js 12.3.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-29927 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo