Executive brief
Next.js is a popular web framework used to build production applications. An authorization bypass vulnerability in Next.js middleware allows unauthenticated attackers to access protected resources and modify application data without valid credentials. Deployed applications relying on middleware-based authorization checks are at risk of unauthorized access and data manipulation.
Technical details
This vulnerability is an improper authorization flaw (CWE-285, CWE-863) in Next.js middleware that allows bypassing authorization checks. The vulnerability can be exploited by sending requests containing the x-middleware-subrequest header, which triggers internal subrequest handling without proper authorization re-validation. An unauthenticated, network-based attacker can exploit this with no user interaction required, achieving both confidentiality and integrity impact. Patches are available for Next.js 12.3.5, 13.5.9, 14.2.25, and 15.2.3; Next.js 11.x users are advised to implement firewall-level mitigations filtering the x-middleware-subrequest header. Vercel-hosted deployments are automatically protected.
Affected products
- Vercel Next.js 12.0.0 through 12.3.4, 13.0.0 through 13.5.8, 14.0.0 through 14.2.24, 15.0.0 through 15.2.2, and 11.1.4 or later
Timeline
- 2025-03-21: disclosed
- 2025-03-21: patched: Patches released for Next.js 12.3.5, 13.5.9, 14.2.25, and 15.2.3