CriticalGHSA-f82v-jwr5-mffwCVE-2025-29927

Authorization Bypass in Next.js Middleware

Published 21 Mar 2025 · Updated 10 Sept 2026

Affected packages

nextnpm
Affected
>=13.0.0 <13.5.9
Fixed in
13.5.9
Update to the fixed version for your release line, for example:npm install next@13.5.9
nextnpm
Affected
>=14.0.0 <14.2.25
Fixed in
14.2.25
Update to the fixed version for your release line, for example:npm install next@14.2.25
nextnpm
Affected
>=15.0.0 <15.2.3
Fixed in
15.2.3
Update to the fixed version for your release line, for example:npm install next@15.2.3
nextnpm
Affected
>=12.0.0 <12.3.5
Fixed in
12.3.5
Update to the fixed version for your release line, for example:npm install next@12.3.5

Details

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

  • For Next.js 15.x, this issue is fixed in 15.2.3
  • For Next.js 14.x, this issue is fixed in 14.2.25
  • For Next.js 13.x, this issue is fixed in 13.5.9
  • For Next.js 12.x, this issue is fixed in 12.3.5
  • For Next.js 11.x, consult the below workaround.

_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

  • Allam Rachid (zhero;)
  • Allam Yasser (inzo_)

Is GHSA-f82v-jwr5-mffw in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.