CVE-2025-29927: The Next.js Middleware Bypass Explained

Next.js middleware normally checks if users can access protected pages. It runs before your page loads and can block unauthorized visitors.

But malicious users can add a special header called x-middleware-subrequest to their HTTP requests. When they do this, Next.js skips running your middleware completely. This means all your security checks get bypassed.

Update: the patched versions below are not safe versions anymore

The versions in the table below still fix CVE-2025-29927, but its “No action needed” rows no longer hold. In December 2025, Next.js disclosed CVE-2025-66478, a CVSS 10.0 remote code execution bug in App Router apps on Next.js 15.x and 16.x, and it has shipped more security releases since.

Upgrade to the latest patch release of your Next.js line and check the Next.js security updates page.

Next.js 16 also renamed middleware.ts to proxy.ts, as the Next.js 16 release post explains.

Here’s what a normal request looks like:

And here’s what a malicious request looks like:

That’s it. By adding this one header, they bypass all your security checks.

What is the x-middleware-subrequest Header?

The x-middleware-subrequest header is an internal Next.js header that prevents infinite loops. When middleware calls pages that also have middleware, this header tracks the chain.

If the same middleware appears 5+ times in the chain, Next.js stops running middleware to prevent stack overflow. The header stores middleware names separated by colons.

The vulnerability exists because Next.js trusts this header in all incoming requests, not just internal ones. By adding this header with five instances of “middleware”, attackers can trick Next.js into skipping the security checks entirely.

Next.js Versions Affected

The vulnerability affects all versions of Next.js from 11.1.4 to 15.2.2. The issue was fixed in the following versions:

The patched versions now validate this header properly to prevent abuse from external requests.

References

• https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw