Is Umami Affected by CVE-2025-29927?

[bufferbandit]

Hi,

I came across CVE-2025-29927, which affects Next.js authentication and authorization middleware. I’m not too familiar with Umami, but does this project use Next.js in a way that makes it vulnerable?

Would appreciate any insights. Thanks!

[mikecao]

No, Umami does not do anything authentication in middleware.

[bufferbandit]

Thanks for the response. Glad to hear.

[nickdirienzo]

++glad to hear as well.

@mikecao when is umami planning to upgrade to 15.2+? While users can suppress this vulnerability, it can also naturally go away with a minor Next upgrade. Thanks!