Tóm tắt nhanh
- CVE-2025-29927 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.1) ảnh hưởng next.js (vercel), next.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 99.2%, cao hơn 99.9% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 12.3.5, 13.5.9, 14.2.25, 15.2.3 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| next.js | ≥ 11.1.4, < 12.3.5≥ 13.0.0, < 13.5.9≥ 14.0.0, < 14.2.25≥ 15.0.0, < 15.2.3
| 12.3.513.5.914.2.2515.2.3
|
| next npm | ≥ 12.0.0, < 12.3.5≥ 13.0.0, < 13.5.9≥ 14.0.0, < 14.2.25≥ 15.0.0, < 15.2.3
| 12.3.513.5.914.2.2515.2.3
|
Mô tả
Impact
It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.
Patches
- For Next.js 15.x, this issue is fixed in
15.2.3
- For Next.js 14.x, this issue is fixed in
14.2.25
- For Next.js 13.x, this issue is fixed in 13.5.9
- For Next.js 12.x, this issue is fixed in 12.3.5
- For Next.js 11.x, consult the below workaround.
Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.
Workaround
If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.
Credits
- Allam Rachid (zhero;)
- Allam Yasser (inzo_)
Mô tả của NVD
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí