A severe security vulnerability has been identified in the Next.js React framework that could allow attackers to bypass authorization checks. Designated as CVE-2025-29927, this flaw carries a critical CVSS score of 9.1 out of 10.0.

According to the Next.js advisory, the vulnerability stems from how the framework handles an internal header called “x-middleware-subrequest,” which is designed to prevent recursive requests from causing infinite loops. The flaw enables attackers to skip middleware execution, potentially bypassing critical security measures such as authorization cookie validation before reaching protected routes.

Security researcher Rachid Allam (also known as zhero and cold-try) discovered and reported the vulnerability, later publishing technical details that increase the urgency for users to implement patches.

“The vulnerability allows attackers to easily bypass authorization checks performed in Next.js middleware, potentially allowing access to sensitive web pages reserved for admins or other high-privileged users,” explained JFrog. They further warned that any website using middleware for user authorization without additional verification checks is vulnerable.

The issue has been patched in Next.js versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3. For users unable to update immediately, the recommended workaround is to block external user requests containing the “x-middleware-subrequest” header from reaching the Next.js application.