---
title: "CVE-2025-29927: The Next.js Middleware Bypass Explained"
description: "The vulnerability skips Next.js middleware security checks by adding a single HTTP header"
canonical: "https://www.trevorlasn.com/blog/cve-2025-29927-nextjs-middleware"
author: "Trevor I. Lasn"
published: "2025-04-06"
last-updated: "2026-11-08"
topics: ["Security", "Next.js"]
---

# CVE-2025-29927: The Next.js Middleware Bypass Explained

The vulnerability skips Next.js middleware security checks by adding a single HTTP header

By Trevor I. Lasn · Published 2025-04-06 · Updated 2026-11-08 · https://www.trevorlasn.com/blog/cve-2025-29927-nextjs-middleware

Next.js middleware normally checks if users can access protected pages. It runs before your page loads and can block unauthorized visitors.

But malicious users can add a special header called `x-middleware-subrequest` to their HTTP requests. When they do this, Next.js skips running your middleware completely. This means all your security checks get bypassed.

## Update: the patched versions below are not safe versions anymore

The versions in the table below still fix CVE-2025-29927, but its "No action needed" rows no longer hold. In December 2025, Next.js disclosed [CVE-2025-66478](https://nextjs.org/blog/CVE-2025-66478), a CVSS 10.0 remote code execution bug in App Router apps on Next.js 15.x and 16.x, and it has shipped more security releases since.

Upgrade to the latest patch release of your Next.js line and check the [Next.js security updates](https://nextjs.org/blog/security) page.

Next.js 16 also renamed `middleware.ts` to `proxy.ts`, as the [Next.js 16 release post](https://nextjs.org/blog/next-16) explains.

Here's what a normal request looks like:

```http title="http"
GET /admin/dashboard HTTP/1.1
Host: trevorlasn.com
Cookie: authToken=1234
```

And here's what a malicious request looks like:

```http title="http"
GET /admin/dashboard HTTP/1.1
Host: trevorlasn.com
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
```

That's it. By adding this one header, they bypass all your security checks.

### What is the x-middleware-subrequest Header?

The `x-middleware-subrequest` header is an internal Next.js header that prevents infinite loops. When middleware calls pages that also have middleware, this header tracks the chain.

If the same middleware appears 5+ times in the chain, Next.js stops running middleware to prevent stack overflow. The header stores middleware names separated by colons.

The vulnerability exists because Next.js trusts this header in all incoming requests, not just internal ones. By adding this header with five instances of "middleware", attackers can trick Next.js into skipping the security checks entirely.

### Next.js Versions Affected

The vulnerability affects all versions of Next.js from 11.1.4 to 15.2.2. The issue was fixed in the following versions:

| Version Range | Status | Action |
|---------------|--------|--------|
| 11.1.4 to 12.3.4 | Vulnerable | Update to 12.3.5 or newer |
| 13.0.0 to 13.5.8 | Vulnerable | Update to 13.5.9 or newer |
| 14.0.0 to 14.2.24 | Vulnerable | Update to 14.2.25 or newer |
| 15.0.0 to 15.2.2 | Vulnerable | Update to 15.2.3 or newer |
| 12.3.5+ | Patched | No action needed |
| 13.5.9+ | Patched | No action needed |
| 14.2.25+ | Patched | No action needed |
| 15.2.3+ | Patched | No action needed |

The patched versions now validate this header properly to prevent abuse from external requests.

### References

- [https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw](https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)