# Postmortem on Next.js Middleware bypass

By Steven Van · 2025-03-25

Vercel details the CVE-2025-29927 timeline, says Vercel-hosted apps were unaffected, and lists changes to disclosure, triage and Next.js version support.

Vercel has published its [postmortem on CVE-2025-29927](<https://vercel.com/blog/postmortem-on-next-js-middleware-bypass>), the critical Next.js Middleware bypass patched the week before. The [Vercel](<https://creatorstoolbox.com/tools/vercel>) write-up sets out a timeline, the technical cause and the changes it is making.

The flaw involved x-middleware-subrequest, an internal header Next.js uses to detect recursion and skip Middleware that has already run. The report reached the Next.js team on 27 February 2025 and was first rated lower priority because it named older 12.x versions. A follow-up on 1 March extended the scope to recent versions, and triage was delayed. The team confirmed the issue on 14 March. Patches shipped on 17 and 18 March for 14.2.25 and 15.2.3, and backports followed for 13.5.9 and 12.3.5.

On who was affected:

- Self-hosted apps using next start or output: 'standalone' were impacted.

- Apps hosted on Vercel were not, because Next.js routing runs in a separate, globally distributed system.

- Netlify and Cloudflare Workers were never affected, for the same reason. Static exports were ruled out because they have no Middleware runtime.

Vercel acknowledges it should have told Netlify and Cloudflare sooner and communicated better with other infrastructure providers and auth partners. Its first changelog reused a template that mentioned its Firewall, which it calls confusing. Vercel also repeats that Middleware should not be the only way to protect routes.

Next steps listed:

- A partner mailing list at partners@nextjs.org.

- Security reports for Next.js now go only through GitHub private vulnerability reporting.

- Improved triage and run books for Next.js vulnerabilities.

- A published LTS policy. The 13.5.9 and 12.3.5 backports were exceptions made after community feedback.

- Documentation for internal headers, or a replacement API, as deployment adapters are built with partners.

- A further security assessment of Middleware.

The researchers, Rachid Allam (zhero) and Yassir Alam (inzo\_), received bug bounty payouts.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/blog/postmortem-on-next-js-middleware-bypass>)

[Read Postmortem on Next.js Middleware bypass on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-postmortem-on-next-js-middleware-bypass>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-postmortem-on-next-js-middleware-bypass