{"cve_id":"CVE-2025-29927","published":"2025-03-21T15:15:42.660000+00:00","last_modified":"2026-06-17T09:05:53.640000+00:00","vuln_status":"Analyzed","description":"Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","base_score":9.1,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"NONE","cwe_ids":["CWE-285","CWE-863"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.99225,"epss_percentile":0.99936,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"PRIV","caps":["AUTH_BYPASS","INFO_DISCLOSURE","PRIV_GAIN","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T11:31:04.688333+00:00","first_seen":"2025-03-21T15:15:42.660000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["vercel"],"products":["next.js"],"affected":[{"vendor":"vercel","product":"next.js","ranges":["≥ 11.1.4 and < 12.3.5","≥ 13.0.0 and < 13.5.9","≥ 14.0.0 and < 14.2.25","≥ 15.0.0 and < 15.2.3"]}]}