Next.js middleware bypass (CVE-2025-29927): how one header skipped auth

What happened

On 21 March 2025, Vercel disclosed CVE-2025-29927, an authorization bypass in Next.js middleware. By sending a crafted x-middleware-subrequest header, an unauthenticated attacker could skip the middleware chain entirely and reach routes that were supposed to be guarded.

The advisory (Vercel security bulletin GHSA-f82v-jwr5-mffw) affects self-hosted Next.js from 11.1.4 up to the fixed releases 12.3.5, 13.5.9, 14.2.25, and 15.2.3. Applications that rely only on middleware for auth — admin pages, API routes, draft preview, image optimization guards — were exposed without any further interaction.

Impact

Middleware is where many teams put their login wall. Skipping it means direct access to customer account pages, internal dashboards, and unprotected data-fetching routes. For commerce storefronts this can mean price-list endpoints, B2B quote APIs, and pre-release catalog pages served to anonymous callers.

The exploit is a single header, so scanning was trivial and exploitation was added to public tooling within a day.

Root cause in one paragraph

Middleware used an internal header to track recursion, and trusted the client-supplied value of that header; a request that carried the internal marker was treated as an already-authorized sub-request, so the auth checks in the middleware chain never ran.

What to do now

• Upgrade to 12.3.5, 13.5.9, 14.2.25, 15.2.3, or later — whichever major line you run.
• Do not rely on middleware alone for authorization; re-check the session server-side in the page, route handler, and data loader.
• Strip x-middleware-subrequest at your CDN or edge (Cloudflare, Fastly, Varnish) as defense in depth.
• Review access logs for that header name on affected versions; treat hits as bypass attempts.
• Rotate any tokens or preview secrets that sat behind middleware-only guards.

What this means for Magento stores

Headless Magento storefronts on Next.js (including several Hyva and PWA-style builds) copy this exact pattern: middleware checks the customer session, then the GraphQL layer assumes the check already happened. Apply the same rule as Magento plugins: authorize at the resource, not just the route. Every resolver that returns customer, order, or B2B quote data must verify ownership again.

Sources

• NVD: CVE-2025-29927
• Vercel / Next.js security advisory GHSA-f82v-jwr5-mffw
• React and Vercel release notes for the fixed versions

Next in this series: SAP NetWeaver unauthenticated upload (CVE-2025-31324) — /blog/cve-2025-sap-netweaver-31324