SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
7 SOURCES ON THIS EVENT
◆ WATCHCVE-2025-29927 · CVSS 9.1

Vercel Next.js: attackers can gain admin rights

AFFECTSVercel Next.js

OFFICIAL NAME: Authorization Bypass in Next.js Middleware

WHAT IT IS · WEBSITE OR ONLINE STOREIt runs public websites, online stores or the software behind them.

DO THIS FIRSTAsk whoever runs your website or store to update it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.

WHY IT RANKS HERE Ready-made attack tools are public. The first report is 20 days old.

HIGHEST CONFIRMED RUNG
TRIED
CISA KEV
NOT YET
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2025-29927 discussed publicly (CIRCL sighting). CVE-2025-29927 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attack attempts on CVE-2025-29927 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2025-29927 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 580 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. MAR 22, 2025
    127 public GitHub repositories claim a proof of concept for CVE-2025-29927
  2. APR 4, 2025
    Exploit-DB entry: Next.js Middleware 15.2.2 - Authorization Bypass
  3. Attack activity. OCT 21, 2026
    Attack attempts on CVE-2025-29927 seen by honeypots (Shadowserver via CIRCL)
  4. OCT 25, 2026
    CVE-2025-29927 discussed publicly (CIRCL sighting) (2 reports, latest OCT 28)
  5. NOV 6, 2026
    Public proof of concept for CVE-2025-29927 (CIRCL sighting)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Next.js Middleware Bypass, OCT 24
  2. [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2025-29927 (CIRCL sighting), NOV 6
  3. [3] CIRCL Vulnerability-Lookup sightings: CVE-2025-29927 discussed publicly (CIRCL sighting), OCT 28
  4. [4] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2025-29927 seen by honeypots (Shadowserver via CIRCL), OCT 21
  5. [5] Exploit-DB: Exploit-DB entry: Next.js Middleware 15.2.2 - Authorization Bypass, APR 4
  6. [6] PoC-in-GitHub: 127 public GitHub repositories claim a proof of concept for CVE-2025-29927, MAR 22
  7. [7] CIRCL Vulnerability-Lookup sightings: 1 more reports