nextjs cve-2025-29927

[dlsaldanas]

https://nextjs.org/blog/cve-2025-29927
please upgrade next to 14.2.25

[solvionsolutions]

The fix is upgrading Next.js to the patched release for your major line: 15.2.3, 14.2.25, 13.5.9, or 12.3.5. The bug let anyone add an x-middleware-subrequest header to skip your middleware entirely, so any auth check living only in middleware.ts was bypassable.

Two things worth doing beyond the bump:

If you can't upgrade right away, strip the x-middleware-subrequest header at your proxy/CDN before it hits the app.
Don't rely on middleware as your only auth gate — re-check auth in the route handler too, so a bypass isn't game over.
Full write-up with the exact affected/patched ranges and the header-stripping configs: https://www.guardlayer.io/blog/nextjs-middleware-auth-bypass-cve-2025-29927