CVE-2025-29927: Middleware Authorization Bypass via x-middleware-subrequest Header in Next.js

HERMES

HERMES THREAT SCORE & SAAS AUTHORIZATION EXPOSURE

Target: Vercel Next.js 11.1.4 through 15.2.2 (Edge & Server Middleware)

Confidence: 99%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 18 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 18 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-29927 at an HTS of 94 (CRITICAL SEVERITY). This architectural flaw in Next.js routing allows any external client to bypass the entire middleware.ts security pipeline by injecting the internal x-middleware-subrequest header. All RBAC checks, authentication gates, and rate limiters are completely bypassed.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-29927: Middleware Authorization Bypass via x-middleware-subrequest Header in Next.jsVULNERABILITY

Connected Nodes: 0

Universal Middleware Authorization Bypass in Next.js

CVSS v3.1: 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) / CWE-285: Improper Authorization.
Exceptional EPSS score of 0.99225 (Percentile: 99.934%). Grants immediate unauthenticated access to protected administrative dashboards and private API routes.

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2025-29927	Official NVD / MITRE record
Associated CWE	CWE-285: Improper Authorization	Complete bypass of application authorization middleware
CVSS v3.1 Score	9.1 CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0 Score	8.8 HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Applicable CPEs	cpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*	Enterprise web applications built on Next.js framework
Affected Versions	>= 11.1.4 < 12.3.5, 13.x < 13.5.9, 14.x < 14.2.25, 15.x < 15.2.3	Projects relying on middleware.ts for route protection
Fixed Versions	12.3.5, 13.5.9, 14.2.25, 15.2.3 (March 2025)	Security releases published by Vercel

---

2. Exploitation

• CISA KEV: Not formally added to KEV, but subjected to widespread automated exploitation.
• EPSS Score: 0.99225 (Percentile: 99.934% — virtually guaranteed active exploitation).
• Operational Status: Trivial exploitation widely documented and utilized by threat actors.
• PoC & Weaponization: A single HTTP header (x-middleware-subrequest: 1) appended to standard requests suppresses middleware execution entirely.
• Access Conditions: Pre-authentication; public network access; zero attack complexity.

---

3. Threat Intelligence

• Threat Actors: Initial access brokers, automated scrapers, and criminal syndicates targeting SaaS applications and fintech portals.
• Observed Campaigns: Systematic automated probes against /admin, /dashboard, and /api/ routes transmitting subrequest headers.
• Associated Malware: Custom API scrapers and data harvesting automation tools.
• Exploitation Timeline: Fixed in security release commit 52a078da3 on March 24, 2025.

---

4. Detection & Forensic Triage

Indicators of Compromise (IOCs)

• External Inbound Header: Detection of x-middleware-subrequest originating from external clients on ingress proxies.
• Unauthenticated Administrative Access: Successful HTTP 200 responses to restricted endpoints without accompanying authentication tokens.

Sigma Rule

title: Next.js Middleware Bypass Attempt via x-middleware-subrequest (CVE-2025-29927)
id: b1c2d3e4-2992-4f89-9012-3456789abcde
status: test
description: Detects external incoming HTTP requests containing the internal Next.js x-middleware-subrequest header
references:
  - https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
author: Hermes Codex Research
date: 2026-09-10
logsource:
  category: webserver
detection:
  selection:
    cs_headers|contains: 'x-middleware-subrequest'
  condition: selection
falsepositives:
  - None expected; external clients should never send this internal header
level: critical

YARA Signature

rule Exploit_Nextjs_Middleware_Bypass_CVE_2025_29927 {
    meta:
        description = "Detects HTTP requests exploiting Next.js middleware bypass"
        author = "Hermes Codex Research"
        date = "2026-09-10"
        reference = "CVE-2025-29927"
    strings:
        $hdr = "x-middleware-subrequest:" ascii nocase
        $admin_uri = "/admin" ascii
        $api_uri = "/api/" ascii
    condition:
        $hdr and ($admin_uri or $api_uri)
}

Suricata / Snort Signature

alert http $EXTERNAL_NET any -> $WEB_SERVERS any (msg:"HERMES - Next.js x-middleware-subrequest Authorization Bypass Attempt (CVE-2025-29927)"; flow:to_server,established; content:"x-middleware-subrequest"; http_header; classtype:policy-violation; sid:202529927; rev:1;)

Logs & Forensic Artifacts

• Reverse Proxy Logs: Check Cloudflare, AWS CloudFront, or Nginx access logs for incoming x-middleware-subrequest.
• Application Audit Logs: Cross-reference administrative API access with authentication session issuance.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1556 (Modify Authentication Process), T1078 (Valid Accounts).

---

5. Remediation & Hardening

1. Upgrade Next.js Framework: Update the next dependency to 15.2.3, 14.2.25, 13.5.9, or 12.3.5.
2. Strip Header at Ingress Proxy: If immediate patching is delayed, configure reverse proxies (Nginx, Envoy) to drop the header: proxy_set_header x-middleware-subrequest "";.
3. Implement Defense in Depth: Do not rely exclusively on middleware for authorization; enforce access validation inside Route Handlers and Server Actions.
4. Audit Historical Access: Review web traffic logs to identify whether unauthorized requests accessed protected routes over preceding months.
5. Redeploy and Invalidate Edge Caches: Purge edge CDN caches and redeploy patched builds across all production regions.

---

6. Enterprise Impact Scenario

”What happens if this vulnerability is exploited in an enterprise?”

1. Target Identification: The attacker identifies an enterprise SaaS platform built with Next.js featuring a restricted /admin dashboard.
2. Header Manipulation: The adversary crafts an HTTP GET request to /admin injecting x-middleware-subrequest: 1.
3. Middleware Suppression: Next.js assumes the request has already been validated by an internal edge worker, skipping middleware.ts.
4. Direct Dashboard Ingress: The attacker enters the administrative portal without possessing login credentials or completing SSO challenges.
5. Data Harvesting and Account Takeover: The adversary extracts sensitive customer records, modifies role permissions, and accesses confidential business operations.