{"id":3351,"date":"2025-03-25T07:38:58","date_gmt":"2025-03-25T07:38:58","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=3351"},"modified":"2025-05-12T05:46:17","modified_gmt":"2025-05-12T05:46:17","slug":"the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/","title":{"rendered":"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">One of the most famous JavaScript frameworks, \u201cNext.Js,\u201d has critical security with a CVE base score of 9.1 by <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-29927\">NIST<\/a>. Next.js is a React framework that provides a structured approach and additional features for building web applications, including server-side rendering and static site generation, built on top of the React library.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The framework is used by Big tech companies and even small startups because of its performance, scalability, and developer-friendly features.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The security researcher <a href=\"https:\/\/zhero-web-sec.github.io\/research-and-things\/nextjs-and-the-corrupt-middleware\">Rachid<\/a> discovered a critical vulnerability in the Next.js Middleware. This vulnerability allows authentication bypass, DOS (Denial of Server), and Cache poising with maliciously crafted URLs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The framework has <strong>131K stars<\/strong> on <a href=\"https:\/\/github.com\/vercel\/next.js\">GitHub<\/a> and is currently downloaded <strong>+ 9,4 million<\/strong> times per week. The following Next.js version is vulnerable to this vulnerability. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>If your organization uses it, upgrade it to the corresponding patched version.<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>For Next.js <strong>15.x,<\/strong> this issue is fixed in <strong>15.2.3.<\/strong><\/li>\n\n\n\n<li>For Next.js <strong>14.x,<\/strong> this issue is fixed in <strong>14.2.25.<\/strong><\/li>\n\n\n\n<li>All Next.js versions starting from <strong>11.1.4<\/strong> up to and including <strong>13.5.6<\/strong> are affected by this vulnerability.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-does-this-vulnerability-occur\">How does this Vulnerability Occur?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To understand the technicality of this vulnerability, you first have to understand Middleware. According to the Next.js <a href=\"https:\/\/nextjs.org\/docs\/app\/building-your-application\/routing\/middleware\">documentation<\/a>, Middleware allows you to run code before a request is completed. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then, based on the incoming request, you can modify the response by rewriting, redirecting, modifying the request or response headers, or responding directly. Middleware runs before cached content and routes are matched.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In simple words, Middleware acts as a checkpoint for your website. Before a request reaches the final destination (like your homepage or a product page), middleware checks the request and decides what to do next. Middleware helps you customize how requests are handled, making your site faster, safer, and more flexible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another main job of the&nbsp; Middleware is access control. It checks for Authentication &amp; Authorization and verifies their session before letting them in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For Example, A user tries to visit\u00a0 <strong>\/&lt;Your web app>\/dashboard\/admin<\/strong>. Middleware jumps in and checks if they\u2019re logged in and have the correct permissions. If yes, allow them through if everything is good; otherwise, redirect them to the login page if they don\u2019t have access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-security-issue-in-next-js\">The Security Issue in Next.js<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Next.js framework middleware checks a special header in the web requests called <strong>x-middleware-subrequest <\/strong>to decide whether it should run. If this header contains the middleware\u2019s name, the middleware is ignored, and the request moves forward. Apart from this, the Middleware\u2019s name is predictable. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The files had to be named _middleware.ts and placed inside the pages\/ folder. The attacker can bypass the middleware and the login mechanism by chaining them together. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is how it is if a request needs to pass through middleware at <strong>\/dashboard\/panel\/admin<\/strong>, an attacker has three possible values for the x-middleware-subrequest header.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>pages\/_middleware<\/li>\n\n\n\n<li>pages\/dashboard\/_middleware<\/li>\n\n\n\n<li>pages\/dashboard\/panel\/_middleware<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-middleware-vulnerability-poc\">The Middleware Vulnerability POC<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are multiple versions of the next js that are vulnerable to this vulnerability, so different Project Structures Need Different Ways to Exploit it:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pages Router (versions 11.1.4-12.1.x):<\/strong> x-middleware-subrequest: pages\/_middleware<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>App Router (versions 12.2.x-13.x):<\/strong> x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>App Router with \/src folder (versions 14.x-15.2.2):<\/strong> x-middleware-subrequest: src\/middleware:src\/middleware:src\/middleware:src\/middleware:src\/middlewar<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The simple payload to version 15.x. If you run the following curl command, it bypasses the middleware and gives you login access.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Exploit (middleware: middleware: middleware: middleware: middleware)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">curl -v -H &#8220;x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware&#8221; \\<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">http:\/\/localhost:3000\/dashboard<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are looking for a vulnerable app for testing and learning purposes, use <strong>this <a href=\"https:\/\/github.com\/Pkhuyar\/nextjs-vulnerable-app\">GitHub repo<\/a>. Follow the steps to deploy the vulnerable app<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Step 1: <code>git clone <\/code><a href=\"https:\/\/github.com\/Pkhuyar\/nextjs-vulnerable-app.git\">https:\/\/github.com\/Pkhuyar\/nextjs-vulnerable-app.git<\/a>\nStep 2: cd nextjs-auth-app\nStep 3: npm install\nStep 4: npm run dev<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerable web app is running on http:\/\/localhost:3000 open it in the browser to view the application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-real-world-security-impacts\">Real-World Security Impacts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability opens several new attacks surface to the Next.js web app. These real-life scenarios occur if your app is vulnerable to this vulnerability:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Authentication Bypass: <\/strong>The attacker can bypass the login pages and gain access to that user with a simple crafted request. The worst case scenario occurs when an attacker gains access to a high-privilege user account such as admin.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CSP (Content Security Policy) Bypass: <\/strong>The middleware also sets a CSP header as a defense mechanism for <a href=\"https:\/\/signmycode.com\/blog\/cross-site-scripting-xss-explained-types-impacts-and-prevention-strategies\">XSS (cross-site scripting) attacks<\/a>. Now, attackers can also execute malicious XSS payloads on the victim.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cache Poising and DOS: <\/strong>The security researcher also claims that in some scenarios, this vulnerability can cause a cache poisoning attack or the Denial of service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Geographic Restrictions Bypass:<\/strong> The developer uses middleware to restrict content by location. If someone uses this vulnerability to exploit the web app, they can bypass this security mechanism.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-protecting-your-organisation\">Protecting Your Organisation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability occurred recently, so fix your web as soon as possible. Now, vulnerability and exploitation are publicly available. Cybercriminals use it to exploit web apps in the wild. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>If you also use the Next.js framework, protect your organization by following these steps:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Update Next.js: <\/strong>The Next.js team released a patch for this vulnerability. Update your Next.js app immediately if you are on the list of vulnerable versions of Next.js.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Use <a href=\"https:\/\/certera.com\/services\/web-application-firewall-waf\">WAF (Web Application Firewall)<\/a> to malicious Header: <\/strong>If you can\u2019t update your web app immediately or don\u2019t know if you are under the vulnerable list, Use a good WAD to block dangerous security headers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For NGINX:<\/strong> nginxCopy<code>location \/ { proxy_set_header x-middleware-subrequest<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>For Apache:<\/strong> apacheCopy<code>RequestHeader unset x-middleware-subrequest<\/code><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This incident reminds us that security is an ongoing process; it is not like we did a one-time setup and it is all done. The popular and well-maintained framework also faces critical vulnerability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We need multiple layers of security to prevent this kind of incident. Use <strong><a href=\"https:\/\/certera.com\/sitelock\">SiteLock Security<\/a><\/strong> to add an extra layer of security. It is a cloud-based security tool that scans your website for malware and vulnerabilities and protects your organization from this type of incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the famous quotes in the cybersecurity world is, \u201cNever trust user input.\u201d Any data from users, including HTTP headers \u2013 can be manipulated. Always validate or sanitize input.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of the most famous JavaScript frameworks, \u201cNext.Js,\u201d has critical security with a CVE base score of 9.1 by NIST. Next.js is a React framework that provides a structured approach and additional features for building web applications, including server-side rendering and static site generation, built on top of the React library. The framework is used<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":3354,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32],"tags":[643,642],"class_list":["post-3351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vulnerability","tag-cve-2025-29927","tag-next-js-vulnerability","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.6 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Critical Severity Vulnerability in the Next.js Framework: CVE-2025-29927<\/title>\n<meta name=\"description\" content=\"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)\" \/>\n<meta property=\"og:description\" content=\"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/\" \/>\n<meta property=\"og:site_name\" content=\"EncryptedFence by Certera - Web &amp; Cyber Security Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-25T07:38:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-12T05:46:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\"},\"headline\":\"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)\",\"datePublished\":\"2025-03-25T07:38:58+00:00\",\"dateModified\":\"2025-05-12T05:46:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/\"},\"wordCount\":1021,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/CVE-2025-29927.webp\",\"keywords\":[\"CVE-2025-29927\",\"Next.js Vulnerability\"],\"articleSection\":[\"Vulnerability\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/\",\"name\":\"Critical Severity Vulnerability in the Next.js Framework: CVE-2025-29927\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/CVE-2025-29927.webp\",\"datePublished\":\"2025-03-25T07:38:58+00:00\",\"dateModified\":\"2025-05-12T05:46:17+00:00\",\"description\":\"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/CVE-2025-29927.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/CVE-2025-29927.webp\",\"width\":960,\"height\":620,\"caption\":\"Critical Next.js Vulnerability\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"name\":\"EncryptedFence by Certera - Web & Cyber Security Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"alternateName\":\"Certera's EncryptedFence Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\\\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.\",\"sameAs\":[\"https:\\\/\\\/certerassl.com\\\/\"],\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/author\\\/certerabguser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Critical Severity Vulnerability in the Next.js Framework: CVE-2025-29927","description":"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/","og_locale":"en_US","og_type":"article","og_title":"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)","og_description":"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.","og_url":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/","og_site_name":"EncryptedFence by Certera - Web &amp; Cyber Security Blog","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2025-03-25T07:38:58+00:00","article_modified_time":"2025-05-12T05:46:17+00:00","og_image":[{"width":960,"height":620,"url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#article","isPartOf":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7"},"headline":"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)","datePublished":"2025-03-25T07:38:58+00:00","dateModified":"2025-05-12T05:46:17+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/"},"wordCount":1021,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"image":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp","keywords":["CVE-2025-29927","Next.js Vulnerability"],"articleSection":["Vulnerability"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/certera.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/","url":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/","name":"Critical Severity Vulnerability in the Next.js Framework: CVE-2025-29927","isPartOf":{"@id":"https:\/\/certera.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp","datePublished":"2025-03-25T07:38:58+00:00","dateModified":"2025-05-12T05:46:17+00:00","description":"Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927. It allows Attackers to Bypass Middleware Authorization Checks.","breadcrumb":{"@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#primaryimage","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/03\/CVE-2025-29927.webp","width":960,"height":620,"caption":"Critical Next.js Vulnerability"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/blog\/the-critical-severity-vulnerability-in-the-next-js-framework-cve-2025-29927\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The Critical Severity Vulnerability in the Next.js Framework (CVE-2025-29927)"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/blog\/#website","url":"https:\/\/certera.com\/blog\/","name":"EncryptedFence by Certera - Web & Cyber Security Blog","description":"","publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"alternateName":"Certera's EncryptedFence Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/blog\/#organization","name":"Certera","url":"https:\/\/certera.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.","sameAs":["https:\/\/certerassl.com\/"],"url":"https:\/\/certera.com\/blog\/author\/certerabguser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/comments?post=3351"}],"version-history":[{"count":3,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3351\/revisions"}],"predecessor-version":[{"id":3531,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/3351\/revisions\/3531"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media\/3354"}],"wp:attachment":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media?parent=3351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/categories?post=3351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/tags?post=3351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}