Vulnerability-Lookup

CVE-2025-29927 (GCVE-0-2025-29927)

Vulnerability from cvelistv5 – Published: 2025-03-21 14:34 – Updated: 2025-04-08 15:17

KEVIntel

Title

Authorization Bypass in Next.js Middleware

Summary

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

8 references

URL	Tags
https://github.com/vercel/next.js/security/adviso…	x_refsource_CONFIRM
https://github.com/vercel/next.js/commit/52a078da…	x_refsource_MISC
https://github.com/vercel/next.js/commit/5fd3ae8f…	x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v12.3.5	x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v13.5.9	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2025/03/23/3
http://www.openwall.com/lists/oss-security/2025/03/23/4
https://security.netapp.com/advisory/ntap-2025032…

Impacted products

1 product

Vendor	Product	Version
vercel	next.js	Affected: >= 11.1.4, < 12.3.5 Affected: >= 14.0.0, < 14.2.25 Affected: >= 15.0.0, < 15.2.3 Affected: >= 13.0.0, < 13.5.9

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: e5ba35a8-add7-4344-82ed-bc8e197689b2

Vulnerability ID: CVE-2025-29927

Status: Confirmed

Status Updated: 2025-12-15 14:29 UTC

Exploited: Yes

Timestamps

First Seen: 2025-12-15

Asserted: 2025-12-15

Scope

Notes: KEVIntel entry: Authorization Bypass in Next.js Middleware | Affected: vercel / next.js | CVSS: 9.1 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Authorization Bypass in Next.js Middleware
Vendor	vercel
Product	next.js
Added Date	2025-12-15T14:29:13.422Z
Cvss Score	9.1
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-19 12:42 UTC | Updated: 2026-06-19 12:42 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-29927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T15:16:38.515188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T15:17:05.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-28T15:03:09.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/23/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/23/4"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250328-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next.js",
          "vendor": "vercel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.1.4, \u003c 12.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 14.0.0, \u003c 14.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 15.0.0, \u003c 15.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 13.0.0, \u003c 13.5.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T13:59:00.478Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw"
        },
        {
          "name": "https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2"
        },
        {
          "name": "https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48"
        },
        {
          "name": "https://github.com/vercel/next.js/releases/tag/v12.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/releases/tag/v12.3.5"
        },
        {
          "name": "https://github.com/vercel/next.js/releases/tag/v13.5.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/releases/tag/v13.5.9"
        }
      ],
      "source": {
        "advisory": "GHSA-f82v-jwr5-mffw",
        "discovery": "UNKNOWN"
      },
      "title": "Authorization Bypass in Next.js Middleware"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-29927",
    "datePublished": "2025-03-21T14:34:49.570Z",
    "dateReserved": "2025-03-12T13:42:22.136Z",
    "dateUpdated": "2025-04-08T15:17:05.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-29927",
      "date": "2026-06-30",
      "epss": "0.99621",
      "percentile": "0.99946"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-29927\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-03-21T15:15:42.660\",\"lastModified\":\"2026-06-17T09:05:53.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.\"},{\"lang\":\"es\",\"value\":\"Next.js es un framework de React para crear aplicaciones web full-stack. En versiones anteriores a la 14.2.25 y la 15.2.3, era posible omitir las comprobaciones de autorizaci\u00f3n dentro de una aplicaci\u00f3n Next.js si esta se realizaba en middleware. Si no es posible aplicar una versi\u00f3n segura, se recomienda evitar que las solicitudes de usuarios externos que contengan el encabezado \\\"x-middleware-subrequest\\\" lleguen a la aplicaci\u00f3n Next.js. Esta vulnerabilidad se corrigi\u00f3 en las versiones 14.2.25 y 15.2.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"vercel\",\"product\":\"next.js\",\"versions\":[{\"version\":\"\u003e= 11.1.4, \u003c 12.3.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 14.0.0, \u003c 14.2.25\",\"status\":\"affected\"},{\"version\":\"\u003e= 15.0.0, \u003c 15.2.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 13.0.0, \u003c 13.5.9\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-08T15:16:38.515188Z\",\"id\":\"CVE-2025-29927\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"11.1.4\",\"versionEndExcluding\":\"12.3.5\",\"matchCriteriaId\":\"6D275D05-70E5-49CA-BCFE-74B31DB3D8EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"13.0.0\",\"versionEndExcluding\":\"13.5.9\",\"matchCriteriaId\":\"49731FD6-617A-42DE-9F95-A7F42809C32F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndExcluding\":\"14.2.25\",\"matchCriteriaId\":\"5F836D0E-1580-40C6-93E5-6DB939E7BA86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.2.3\",\"matchCriteriaId\":\"E214D84F-7B55-4089-B1C4-9BF8B7AC7375\"}]}]}],\"references\":[{\"url\":\"https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vercel/next.js/releases/tag/v12.3.5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/vercel/next.js/releases/tag/v13.5.9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/03/23/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/03/23/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20250328-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/03/23/3\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/03/23/4\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250328-0002/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-03-28T15:03:09.597Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-29927\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-08T15:16:38.515188Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-21T15:17:22.967Z\"}}], \"cna\": {\"title\": \"Authorization Bypass in Next.js Middleware\", \"source\": {\"advisory\": \"GHSA-f82v-jwr5-mffw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"vercel\", \"product\": \"next.js\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 11.1.4, \u003c 12.3.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 14.0.0, \u003c 14.2.25\"}, {\"status\": \"affected\", \"version\": \"\u003e= 15.0.0, \u003c 15.2.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 13.0.0, \u003c 13.5.9\"}]}], \"references\": [{\"url\": \"https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw\", \"name\": \"https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2\", \"name\": \"https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48\", \"name\": \"https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vercel/next.js/releases/tag/v12.3.5\", \"name\": \"https://github.com/vercel/next.js/releases/tag/v12.3.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vercel/next.js/releases/tag/v13.5.9\", \"name\": \"https://github.com/vercel/next.js/releases/tag/v13.5.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-04-08T13:59:00.478Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-29927\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-08T15:17:05.315Z\", \"dateReserved\": \"2025-03-12T13:42:22.136Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-21T14:34:49.570Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

NCSC-2025-0096

Vulnerability from csaf_ncscnl - Published: 2025-03-25 08:38 - Updated: 2025-03-25 08:38

Summary

Kwetsbaarheid verholpen in Next.js

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Vercel heeft een kwetsbaarheid verholpen in Next.js (Specifiek voor versies 14.2.25 en 15.2.3)

Interpretaties: Next.js is een populair framework voor het ontwikkelen van web-applicaties. De kwetsbaarheid bevindt zich in de manier waarop Next.js authenticatiecontroles in de eigen middleware verwerkt. Dit stelt kwaadwillenden in staat om deze controles te omzeilen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige gegevens en functionaliteiten, waaronder mogelijk de beheer-interface van de getroffen applicaties.

Oplossingen: Vercel heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie. Indien het inzetten van de updates (nog) niet mogelijk is op korte termijn, heeft Vercel ook een mitigerende maatregel gepubliceerd, om het risico van misbruik te verkleinen. Blokkeer externe requests welke de header `x-middleware-subrequest` bevat.

Kans: medium

Schade: high

CWE-285: Improper Authorization

CVE-2025-29927

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-285 - Improper Authorization

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
vers:unknown/>14.0.0\|<14.2.25 Vercel / Next.js		vers:unknown/>14.0.0\|<14.2.25
vers:unknown/>15.0.0\|<15.2.3 Vercel / Next.js		vers:unknown/>15.0.0\|<15.2.3
vers:unknown/>=11.1.4\|<=13.5.6 Vercel / Next.js		vers:unknown/>=11.1.4\|<=13.5.6
vers:unknown/unknown Vercel / Next.js		vers:unknown/unknown

References

2 references

URL	Category
https://nextjs.org/blog/cve-2025-29927	external
https://api.ncsc.nl/velma/v1/vulnerabilities/2025…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Vercel heeft een kwetsbaarheid verholpen in Next.js (Specifiek voor versies 14.2.25 en 15.2.3)",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Next.js is een populair framework voor het ontwikkelen van web-applicaties. De kwetsbaarheid bevindt zich in de manier waarop Next.js authenticatiecontroles in de eigen middleware verwerkt. Dit stelt kwaadwillenden in staat om deze controles te omzeilen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige gegevens en functionaliteiten, waaronder mogelijk de beheer-interface van de getroffen applicaties.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Vercel heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie. Indien het inzetten van de updates (nog) niet mogelijk is op korte termijn, heeft Vercel ook een mitigerende maatregel gepubliceerd, om het risico van misbruik te verkleinen.\n\nBlokkeer externe requests welke de header `x-middleware-subrequest` bevat.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://nextjs.org/blog/cve-2025-29927"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Next.js",
    "tracking": {
      "current_release_date": "2025-03-25T08:38:53.524904Z",
      "generator": {
        "date": "2025-02-25T15:15:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.0"
        }
      },
      "id": "NCSC-2025-0096",
      "initial_release_date": "2025-03-25T08:38:53.524904Z",
      "revision_history": [
        {
          "date": "2025-03-25T08:38:53.524904Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003e14.0.0|\u003c14.2.25",
                "product": {
                  "name": "vers:unknown/\u003e14.0.0|\u003c14.2.25",
                  "product_id": "CSAFPID-2542687"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003e15.0.0|\u003c15.2.3",
                "product": {
                  "name": "vers:unknown/\u003e15.0.0|\u003c15.2.3",
                  "product_id": "CSAFPID-2542688"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003e=11.1.4|\u003c=13.5.6",
                "product": {
                  "name": "vers:unknown/\u003e=11.1.4|\u003c=13.5.6",
                  "product_id": "CSAFPID-2542686"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/unknown",
                "product": {
                  "name": "vers:unknown/unknown",
                  "product_id": "CSAFPID-2552436"
                }
              }
            ],
            "category": "product_name",
            "name": "Next.js"
          }
        ],
        "category": "vendor",
        "name": "Vercel"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-29927",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2542687",
          "CSAFPID-2542688",
          "CSAFPID-2542686",
          "CSAFPID-2552436"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-29927",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-29927.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2542687",
            "CSAFPID-2542688",
            "CSAFPID-2542686",
            "CSAFPID-2552436"
          ]
        }
      ],
      "title": "CVE-2025-29927"
    }
  ]
}

WID-SEC-W-2025-0627

Vulnerability from csaf_certbund - Published: 2025-03-24 23:00 - Updated: 2025-12-23 23:00

Summary

Vercel Next.js: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Next.js ist ein Framework für React-basierte Web-Anwendungen.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2025-29927

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Vercel Next.js <15.2.3 Vercel / Next.js		<15.2.3
Vercel Next.js <13.5.9 Vercel / Next.js		<13.5.9
Vercel Next.js <14.2.25 Vercel / Next.js		<14.2.25
Vercel Next.js <12.3.5 Vercel / Next.js		<12.3.5

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://nextjs.org/blog/cve-2025-29927	external
https://github.com/advisories/GHSA-f82v-jwr5-mffw	external
https://github.com/websecnl/CVE-2025-29927-PoC-Exploit	external
https://github.com/vercel/next.js/releases	external
https://beelzebub.ai/blog/threat-huntinga-analysi…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Next.js ist ein Framework f\u00fcr React-basierte Web-Anwendungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0627 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0627.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0627 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0627"
      },
      {
        "category": "external",
        "summary": "Next.js Blog: CVE-2025-29927 vom 2025-03-24",
        "url": "https://nextjs.org/blog/cve-2025-29927"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-f82v-jwr5-mffw vom 2025-03-24",
        "url": "https://github.com/advisories/GHSA-f82v-jwr5-mffw"
      },
      {
        "category": "external",
        "summary": "PoC vom 2025-03-24",
        "url": "https://github.com/websecnl/CVE-2025-29927-PoC-Exploit"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2025-03-24",
        "url": "https://github.com/vercel/next.js/releases"
      },
      {
        "category": "external",
        "summary": "Exploit vom 2025-12-24",
        "url": "https://beelzebub.ai/blog/threat-huntinga-analysis-of-a-nextjs-exploit-campaign/"
      }
    ],
    "source_lang": "en-US",
    "title": "Vercel Next.js: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2025-12-23T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-24T08:54:58.101+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-0627",
      "initial_release_date": "2025-03-24T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-03-24T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-12-23T23:00:00.000+00:00",
          "number": "2",
          "summary": "Exploit aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c15.2.3",
                "product": {
                  "name": "Vercel Next.js \u003c15.2.3",
                  "product_id": "T042123"
                }
              },
              {
                "category": "product_version",
                "name": "15.2.3",
                "product": {
                  "name": "Vercel Next.js 15.2.3",
                  "product_id": "T042123-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vercel:next.js:15.2.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.5.9",
                "product": {
                  "name": "Vercel Next.js \u003c13.5.9",
                  "product_id": "T042124"
                }
              },
              {
                "category": "product_version",
                "name": "13.5.9",
                "product": {
                  "name": "Vercel Next.js 13.5.9",
                  "product_id": "T042124-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vercel:next.js:13.5.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.2.25",
                "product": {
                  "name": "Vercel Next.js \u003c14.2.25",
                  "product_id": "T042125"
                }
              },
              {
                "category": "product_version",
                "name": "14.2.25",
                "product": {
                  "name": "Vercel Next.js 14.2.25",
                  "product_id": "T042125-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vercel:next.js:14.2.25"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.3.5",
                "product": {
                  "name": "Vercel Next.js \u003c12.3.5",
                  "product_id": "T042126"
                }
              },
              {
                "category": "product_version",
                "name": "12.3.5",
                "product": {
                  "name": "Vercel Next.js 12.3.5",
                  "product_id": "T042126-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vercel:next.js:12.3.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Next.js"
          }
        ],
        "category": "vendor",
        "name": "Vercel"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-29927",
      "product_status": {
        "known_affected": [
          "T042123",
          "T042124",
          "T042125",
          "T042126"
        ]
      },
      "release_date": "2025-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-29927"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-29927 (GCVE-0-2025-29927)

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

NCSC-2025-0096

WID-SEC-W-2025-0627

Tags

Sightings

Nomenclature