CVE-2025-29927

Description

Authorization Bypass in Next.js Middleware

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
• https://nvd.nist.gov/vuln/detail/CVE-2025-29927
• https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
• https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v12.3.5
• https://github.com/vercel/next.js/releases/tag/v13.5.9
• https://security.netapp.com/advisory/ntap-20250328-0002
• https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
• http://www.openwall.com/lists/oss-security/2025/03/23/3
• http://www.openwall.com/lists/oss-security/2025/03/23/4