# Protection against Next.js CVE-2025-29927

By Steven Van · 2025-03-22

Vercel-hosted apps were never exposed to the Next.js Middleware bypass, but self-hosted apps should update to 15.2.3, 14.2.25 or a backport.

A critical Next.js vulnerability, **CVE-2025-29927**, let attackers bypass authorization in Middleware by sending a crafted x-middleware-subrequest header. [Vercel's postmortem](<https://vercel.com/blog/postmortem-on-next-js-middleware-bypass>) says [Vercel](<https://creatorstoolbox.com/tools/vercel>) customers were not affected, because Next.js routing logic runs in a separate, globally distributed system there. Netlify and Cloudflare Workers were also confirmed never to have been affected.

Self-hosted apps using next start or output: 'standalone' were affected. Static exports were ruled out, since Middleware needs a server runtime. Patches shipped for Next.js 15.2.3 and 14.2.25, with backports for 13.5.9 and 12.3.5. For apps that cannot upgrade, the workaround is to filter out the header before it reaches the Next.js server.

The postmortem also covers the timeline. The report arrived on 27 Feb 2025 and was triaged late, partly because the first report named only old 12.x versions. Vercel says its initial changelog reused a Firewall-related template, which was confusing, and that it should have communicated better with other infrastructure providers.

Follow-up changes:

- A partner mailing list (partners@nextjs.org) for infrastructure providers and other Next.js dependents.

- Next.js security reports now go only through GitHub's private vulnerability reporting.

- A published LTS policy, which puts Next.js 11.x and 12.x out of support for security patches.

- Documentation of internal headers, or replacement with an API, as deployment adapters are built with partners.

- Further review of Middleware security. Vercel also recommends against using Middleware as the only way to protect routes.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/blog/postmortem-on-next-js-middleware-bypass>)

[Read Protection against Next.js CVE-2025-29927 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-protection-against-next-js-cve-2025-29927>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-protection-against-next-js-cve-2025-29927