CVE-2025-29927: Next.js Middleware Auth Bypassed via Internal Header Exploit

A critical vulnerability tracked as CVE-2025-29927 affects Next.js versions prior to 15.2.3, allowing attackers to bypass middleware-based authentication entirely. The flaw stems from an internal header, x-middleware-subrequest, which Next.js uses to prevent middleware from executing repeatedly during subrequests. Because the framework never verifies whether this header originates from an internal source, any external HTTP client can send it with the middleware module name repeated five times to skip middleware execution. This grants unauthenticated access to protected pages that rely solely on middleware for auth checks, exposing sensitive data without any credentials. Developers are advised to upgrade to Next.js 15.2.3 or later and implement server-side authentication checks directly within route handlers and page components as an additional security layer.