# CVE-2025-29927 Authorization Bypass in Next.js Middleware

DevFeed: [CVE-2025-29927 Authorization Bypass in Next.js Middleware](<https://devfeed.tech/articles/cve-2025-29927-authorization-bypass-in-next-js-middleware-7879.md>)

Original publisher: [Read original article](<https://snyk.io/blog/cve-2025-29927-authorization-bypass-in-next-js-middleware/>)

Author: Liran Tal

Published: 2025-03-23T04:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [applications](<https://devfeed.tech/tags/applications.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [http](<https://devfeed.tech/tags/http.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

The article reports CVE-2025-29927, a critical authorization-bypass vulnerability in Next.js middleware. It identifies affected Next.js version ranges, recommends upgrading to a fixed release, and describes hosting-platform mitigation status.

## Source excerpt

On Friday morning, March 21, 2025, at 9:00 a.m. UTC, a security advisory identified as CVE-2025-29927 was published. It cited a critical 9.1 severity vulnerability for mainstream Next.js applications.