CVE-2025-29927Disclosure(vercel / next.js)

You are exaggerating this for engagement. You are massively overstating this based on partial facts. CVE-2025-29927 was mainly a middleware auth bypass affecting some self-hosted Next.js apps, not a universal one-request compromise of every deployment. Most of the scary claims only apply to poorly segmented systems relying entirely on middleware for security. The real takeaway is that modern frameworks like Next.js have become complex enough that frontend abstractions now create real infrastructure-level security risks.

What started as bash scripts and scheduled scans evolved into full scale cloud-native execution with Nuclei Cloud. When the Next.js CVE-2025-29927 dropped, Elastic scanned 14,500 assets in under 5 minutes, something that previously took days. Read the full customer story here 👇   https://projectdiscovery.io/blog/how-elastic-scaled-proactive-detection-with-projectdiscovery-cloud

This week exploitation attempts arrived in same-day cohorts across unrelated flaws. Adversaries escalated a Next.js authorization bypass, CVE-2025-29927, across the final three days of the period, from no more than three daily sources to 495 across a partial final day, still climbing when the window closed. It is rated CVSS 9.1 and absent from CISA's Known Exploited Vulnerabilities catalog, so a KEV-driven queue never raises it. On 30 August adversaries checked for nine legacy Citrix flaws in a single day, running matched source sets against eight of them and producing fewer than 1,000 attempts in total. A cohort that ends within the day never sustains enough volume to cross a rate threshold. Count distinct sources per product family per day. Customers get the full weekly brief. Our public At The Edge one-pager is attached + 🔗 https://www.greynoise.io/resources/at-the-edge-clear-083126

A hidden button isn't authorization, and neither is the framework's middleware (proxy in Next.js 16). One forged internal header bypassed Next.js middleware auth in March 2025 (CVE-2025-29927, CVSS 9.1). Next.js fixed four more middleware bypasses in May 2026 and a fifth in July. The check that holds sits next to the data access: every server action and every query that touches protected data asks whether this user may do this to this object. In the simplest case it is short: load the user, compare the owner, then run the query. If an agent wrote your app, grep the server actions. For each one on protected data, find where that check runs. Count the ones where it runs nowhere.

New PCPJack worm targets cloud infrastructure, stealing credentials from Docker/Kubernetes/Redis while actively removing TeamPCP infections. Exploits 5 recent CVEs including CVE-2025-29927 and CVE-2026-1357 for initial access. #DFIR_Radar https://t.co/4pMlgIN6MQ

We just got hit with worst cybersecurity attack. Issue traced back to Opus committing "Good for now, not a big deal" on a well known vulnerability from last year "CVE-2025-29927" In order to fix an issue, Opus 4.6 chose to downgrade Nextjs to 15.0.3 which has sever known issue.

(CVE-2025-29927). This is what PreBreach scans for.

🚨 CVE-2026-1281 Critical Code Injection in Ivanti EPMM: What You Should Know 🚨 Discover the key information you need to know about CVE-2025-29927, an authentication bypass vulnerability in the middleware layer in Vercel’s Next.js. Learn more: https://plrsg.ht/4c4BxVR https://t.co/aD5hARFXHm

1/4: Next.js sitenizin kapısını açık mı bıraktınız? (CVE-2025-29927) 🚨 Tüm auth ve CSP katmanınızı tek bir header ile geçmek mümkün. Şu anki meta: **x-middleware-subrequest** suistimali. Nasıl çalıştığını ve korunma yollarını inceleyelim. 🧵 2/4:Hata Nerede? 🔍 Middleware, Next.js'in "gatekeeper"ıdır. Ancak bazı versiyonlarda dışarıdan gelen x-middleware-subrequest header'ı Next.js'i şu konuda kandırabiliyor: "Bu istek zaten middleware'den geçti, tekrar kontrol etme." 3/4:Exploit Vektörü ☣️ İstek başlığına şunu eklemek yeterli: • Header: x-middleware-subrequest • Value: http://middlewareInfo.name (örn: src/middleware) Sonuç: Auth guard'lar devre dışı, veriler açıkta. 🔓 4/4: Acil Eylem Planı ✅ • **Versiyon Güncelle:** 15.2.3+ veya 14.2.25+ sürümüne hemen geçin. • **WAF/Edge:** Dışarıdan gelen x-middleware-subrequest başlıklarını WAF üzerinden bloklayın. #NextJS #CyberSecurity #WebDev #LemmaAI

@_ar9av @prismor_dev the critical ones include CVE-2025-29927 , CVE-2025-7783 , CVE-2023-50447 , CVE-2025-43859, CVE-2023-39662 , CVE-2024-23751 , CVE-2025-1793 this one has a sql injection vulnerability , CVE-2023-39631 , CVE-2024-3829 , CVE-2023-6730 , CVE-2025-64712 and more..

NØX Echo Lineage Signal: CVE-2025-29927 Entity: next.js Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation Relationship: - next.js → CVE-2025-29927 → Evidence → Operational Risk Current State: DISCLOSED, POC_AVAILABLE, ACTIVE_EXPLOITATION

@zhero___ Regarding the Next.js middleware bypass (CVE-2025-29927) did you report it to Vercel first and only go after bug bounty programs after the fix, or did you also report it to vulnerable programs immediately after report it to vendor ? Curious about your approach.

‼️🇺🇸 CRITICAL VULNERABILITY CLAIM — NYU SUBDOMAIN Threat actor ShadowByt3S claims to have identified a potentially vulnerable New York University (NYU) subdomain affected by CVE-2025-29927, a critical vulnerability with a reported CVSS score of 9.1. 🔎 Claimed status: Vulnerability scan confirmed 🎯 Target: NYU subdomain 🆔 CVE: CVE-2025-29927 💰 Asking price: $60 💳 Payment: BTC / XMR ⚠️ The actor states the vulnerability has not yet been exploited and is offering the claimed finding for sale. The claim, affected subdomain, scan results and exploitability have not been independently verified. #CyberSecurity #CVE #Vulnerability #NYU #ThreatIntel #CyberThreat #InfoSec

CVE-2025-29927. CVSS 9.1.

For a while in 2025 you could walk past authentication on a huge number of Next.js apps by adding one header to a request. CVE-2025-29927. Severity 9.1. #nextjs

CASE FILE: Developer used Claude Code and OpenAI Codex to "vibe code" a Next.js app. AI pinned a vulnerable dependency version. Result? CVE-2025-29927 exploited, middleware bypassed, cryptominer deployed. The attack chain: AI-generated project → vulnerable dependency → automated scan → cryptominer. Speed without brakes = security debt at scale. 📁⛏️⚖️

Your Next.js middleware runs on every request. Or it's supposed to. CVE-2025-29927 let attackers skip it entirely — with a single HTTP header. No exploit code. No auth bypass tool. Just curl and one header. If middleware was your only auth layer, every protected route was open. Affected: Next.js 11.1.4 → 15.2.2. Four years of releases. Full breakdown, what to check in your logs, and how to add a second auth layer 👇 https://datahogo.com/en/blog/cve-2025-29927-nextjs-middleware-auth-bypass #nextjs #webdev #appsec

Someone added one HTTP header to a request. The dashboard loaded. No login. No session. No credentials. Just: x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware That's CVE-2025-29927. It bypassed every Next.js middleware check in versions 11.1.4 through 15.2.2. Admin panel? Open. Billing page? Open. User data? Open. If your auth lives only in middleware.ts — check your version. #nextjs #webdev #cybersecurity

And then there's CVE-2025-29927. A single curl command bypassed ALL middleware auth checks in Next.js. Every app that relied on middleware-only auth was vulnerable. If your "protected" routes only check auth in middleware you have a security hole, not a feature.

NØØT Security Alerts Classification: Critical CVE: CVE-2025-29927 Product: vercel / next.js Summary: VulnCheck reports real-world exploitation activity affecting vercel / next.js. Evidence: Public PoC/exploit available; Active exploitation reported; Live exploitation observed by VulnCheck canaries Impact: The vulnerability can materially affect exposed systems; verify vendor-specific impact and affected versions. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 28 Mar 2025 Source: https://vulncheck.com/xdb/bf3470ff5f46 #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #next_js #CVE_2025_29927 #ActiveExploitation #Exploit