Next.js Authorization Bypass Vulnerability (CVE-2025-29927)
[ad_1] A critical vulnerability in the Next.js framework, officially disclosed on March 21, 2025, allows attackers to bypass middleware security controls through a simple header manipulation. This post summarizes what we know about CVE-2025-29927, how you can mitigate the vulnerability, and how Acunetix can help you detect and confirm your organization’s risk. What you need to know about CVE-2025-29927 A remote authorization bypass vulnerability identified as CVE-2025-29927 was confirmed in Next.js, one of the most popular React frameworks used to build web applications. The vulnerability allows attackers to completely bypass Next.js functionality in an application, including commonly used critical security functions such as authentication and authorization. As of March 24, 2025, Acunetix has an active security check to detect and report exploitable Next.js versions. The vulnerability affects the following Next.js versions: Next.js 11.1.4 through 13.5.6 (unpatched) Next.js 14.x before 14.2.25 […]