Next.js CVE-2025-29927 middleware authorization bypass (x-middleware-subrequest header): is my self-hosted app affected and which Next.js versions fix it?

What it is: CVE-2025-29927 (CVSS 9.1, disclosed March 21, 2025) lets an outside request make Next.js skip middleware entirely by sending an internal header, x-middleware-subrequest. Apps that do authentication, authorization, redirects or security headers only in middleware.ts can expose protected pages and API routes to anyone. Am I affected: - Next.js 11.1.4 through 15.2.2 that is self-hosted (next start, output: 'standalone', Docker, a Node server behind your own proxy) and relies on middleware for access control. - Apps hosted on Vercel or Netlify, and static exports (no middleware runs), were reported as not affected. - Check: npm ls next, and look at what your middleware.ts enforces. Fix: 1. Upgrade to Next.js 15.2.3, 14.2.25, 13.5.9 or 12.3.5 or later (current releases are fixed; versions before 12 have no fix, so upgrade them). 2. If you can't upgrade right away, drop the x-middleware-subrequest header from all incoming requests at your reverse proxy, load balancer, CDN or WAF before they reach Next.js. 3. Don't rely on middleware alone for authorization: also check the session in the route handler, server action or data layer that returns protected data. After: review access logs since March 2025 for requests carrying x-middleware-subrequest or reaching protected routes without a session, and rotate anything that may have been exposed through those routes. Sources: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw https://www.fastly.com/blog/cve-2025-29927-authorization-bypass-in-next-js https://threatprotect.qualys.com/2025/03/25/next-js-middleware-authorization-bypass-vulnerability-cve-2025-29927/