Critical · published March 21, 2025
CVSS calls it critical at 9.1. It sits in the 99.9th percentile for exploit probability.
🚨 A sneaky bypass lurking in Next.js middleware could let unauthorized users slip right through! 🔥 Think of it as a restaurant where the bouncer checks IDs at the door, but a clever guest distracts him, allowing anyone to stroll right in. If the authorization isn't properly enforced in your kitchen, anyone could take a seat and start ‘ordering’ without a reservation! If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive parts of your application, potentially exposing user data or altering internal operations. It’s absolutely devastating if the wrong person walks in and starts tampering with your data!
Think of it as a restaurant where the bouncer checks IDs at the door, but a clever guest distracts him, allowing anyone to stroll right in. If the authorization isn't properly enforced in your kitchen, anyone could take a seat and start ‘ordering’ without a reservation! This vulnerability stems from improper authorization checks in Next.js middleware versions 1.11.4 up to but not including 12.3.5, 13.5.9, 14.2.25, and 15.2.3, allowing users to bypass security measures.
If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive parts of your application, potentially exposing user data or altering internal operations. It’s absolutely devastating if the wrong person walks in and starts tampering with your data! To secure your application, immediately upgrade to Next.js versions 12.3.5, 13.5.9, 14.2.25, or 15.2.3. If upgrading isn't possible right away, block external requests that include the x-middleware-subrequest header from reaching your application. Don't leave the front door wide open! This is fixable! With these steps, you'll have your security back on track in no time. 🛡️