CVE-2025-29927

criticalPriorität · beachten · 45OT-Risiko · hochEPSS 0.992 · 100. PerzentilExploit · funktionalDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

129 exploits · funktional

Likely / severe?

99.2% (100th) EPSS

CVSS 9.1 · critical

Is it mine?

31 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 3.9 · Auswirkung 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-863USprimärCWE-285USCWE-285USCWE-285USCWE-285USCWE-863US

Exploits (129)

Öffentlicher Proof-of-Concept- und Exploit-Code.

auxiliary/scanner/http/nextjs_middleware_auth_bypassNext.js Middleware Authorization Bypass Scannerfunktional · metasploit
EDB-52124Next.js Middleware 15.2.2 - Authorization BypassPoC · exploit_db
0xPThree/next.js_cve-2025-299270xPThree/next.js_cve-2025-29927PoC · poc_in_github
0xPb1/Next.js-CVE-2025-299270xPb1/Next.js-CVE-2025-29927PoC · poc_in_github
0xWhoknows/CVE-2025-29927Async Python scanner for Next.js CVE-2025-29927. Uses aiohttp & aiofiles to efficiently process large URL lists, detect vulnerabilities, and save results. Features connection pooling, caching, and chunked processing for fast performancePoC · poc_in_github
0xb1lal/CVE-2025-29927Next.js CVE-2025-29927 güvenlik açığı hakkındaPoC · poc_in_github

betroffene Produkte (31)

Betroffene Produkte und Versionsbereiche.

Vercel Next.js <12.3.5alle Versionencert_bundDE
Vercel Next.js <13.5.9alle Versionencert_bundDE
Vercel Next.js <14.2.25alle Versionencert_bundDE
Vercel Next.js <15.2.3alle Versionencert_bundDE
vercel next.js< 12.3.5cert_bundDE
vercel next.js< 13.5.9cert_bundDE
vercel next.js< 14.2.25cert_bundDE
vercel next.js< 15.2.3cert_bundDE
vercel next.js≤ 11.1.4, ≤ 1 3.5.6enisa_euvdEU
vercel next.js11.1.4, → 12.3.5enisa_euvdEU
vercel next.js13.0.0, → 13.5.9enisa_euvdEU
vercel next.js14.0.0, → 14.2.25enisa_euvdEU
vercel next.js15.0.0, → 15.2.3enisa_euvdEU
vercel next.js> 14.0.0, → 14.2.25enisa_euvdEU
vercel next.js> 15.0.0, → 15.2.3enisa_euvdEU
vercel next.js≤ 14.2.25fstec_bduRU
vercel next.js≤ 12.3.5fstec_bduRU
vercel next.js≤ 13.5.9fstec_bduRU
vercel next.js≤ 15.2.3fstec_bduRU
vercel next.js≤ vers:unknown/>14.0.0|<14.2.25ncsc_nlNL

20 von 31 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2025-0096Kwetsbaarheid verholpen in Next.jsNL2025-03-25csaf · ncsc_nlNL
Vercel heeft een kwetsbaarheid verholpen in Next.js (Specifiek voor versies 14.2.25 en 15.2.3)
WID-SEC-W-2025-0627Vercel Next.js: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-03-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-f82v-jwr5-mffwAuthorization Bypass in Next.js Middleware2025-03-21ghsa · osvUS
# Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. # Patches * For Next.js 15.x, this issue is fixed in `15.2.3` * For Next.js 14.x, this issue is fixed in `14.2.25` * For Next.js 13.x, this issue is fixed in 13.5.9 * For Next.js 12.x, this issue is fixed in 12.3.5 * For Next.js 11.x, consult the below workaround. _Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._ # Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application. ## Credits - Allam Rachid (zhero;) - Allam Yasser (inzo_)

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

veröffentlicht 2025-03-21geändert 2026-06-17

verwandt (5,011)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-71362US	—OT kritisch	90.5% (100th)	KEV	2026-08-11
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated acc…
CVE-2026-42016US	high8.8OT kritisch	8.64% (95th)	KEV	2026-07-27
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s…
CVE-2025-55177US	—OT kritisch	13.1% (96th)	KEV	2025-08-29
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78…
CVE-2025-54253US	—OT kritisch	88.8% (100th)	KEV	2025-08-05
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this…
CVE-2025-21479US	—OT kritisch	0.84% (58th)	KEV	2025-06-03
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

+5006 weitere

Referenzen (23)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan