CVE-2025-29927: 
JavaScript Schwachstellenanalyse und -minderung

Next.js, a React framework for building full-stack web applications, disclosed a critical security vulnerability (CVE-2025-29927) that affects versions prior to 14.2.25 and 15.2.3. The vulnerability was discovered on February 27, 2025, and publicly disclosed on March 21, 2025. This security flaw affects self-hosted Next.js applications using middleware with 'next start' and 'output: standalone' configurations (GitHub Advisory, Next.js Blog).

The vulnerability stems from the improper handling of an internal header 'x-middleware-subrequest' which Next.js uses to prevent recursive requests from triggering infinite loops. When this header is included in requests to protected routes, Next.js incorrectly allows the request to bypass middleware execution entirely, potentially circumventing critical security checks. The vulnerability has been assigned a CVSS v3.1 score of 9.1 (Critical) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high severity with potential for unauthorized access and data modification (JFrog Blog, GitHub Advisory).

The vulnerability can lead to authorization bypass in applications that rely on middleware for security checks. If successfully exploited, attackers could bypass authentication mechanisms, access protected routes, and potentially gain unauthorized access to sensitive information. In some cases, the vulnerability could also lead to cache poisoning and denial of service conditions (Rapid7 Blog, JFrog Blog).

The vulnerability is relatively straightforward to exploit, requiring only the addition of the x-middleware-subrequest header to HTTP requests when accessing protected resources. The exploitation doesn't require special privileges or user interaction, making it particularly dangerous. However, applications hosted on Vercel or Netlify, as well as those deployed as static exports, are not affected by this vulnerability (GitHub Advisory, Hacker News).

The vulnerability has been patched in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3. If upgrading is not immediately possible, organizations can implement a workaround by preventing external user requests containing the x-middleware-subrequest header from reaching their Next.js application. This can be achieved through web server configurations or Web Application Firewall (WAF) rules. Cloudflare users can enable a managed WAF rule for protection (GitHub Advisory, JFrog Blog).

The vulnerability has garnered significant attention in the security community, with multiple security firms and researchers publishing detailed analyses. Next.js has acknowledged that while they published the CVE promptly, they 'missed the mark on partner communications' and are establishing a partner mailing list to improve future vulnerability communications (OSS Security).