CVE-2025-29927

Katalog CVE

CVSS 9.1 · Critical EPSS 99,2%

Kerentanan Improper Authorization pada vercel next.js. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Rincian

Terbit di NVD

21 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

99,2% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw advisory vendor
• https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2 patch
• https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48 patch
• http://www.openwall.com/lists/oss-security/2025/03/23/3 mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250328-0002/ advisory pihak ketiga
• https://github.com/vercel/next.js/releases/tag/v12.3.5 release notes
• https://github.com/vercel/next.js/releases/tag/v13.5.9 release notes
• http://www.openwall.com/lists/oss-security/2025/03/23/4 mailing list