The UK’s National Cyber Security Centre is encouraging UK organisations to take immediate action to mitigate a vulnerability affecting Next.js, a popular open source web development network.

The framework is often used to build full-stack web applications in use in the UK and around the world.

The NCSC has published a security advisory detailing an authorisation bypass vulnerability present in Next.js, a popular and open-source React-based web development framework that is used to build full-stack web applications in use in the UK and around the world.

An attacker may be able to exploit this vulnerability by sending an external request to the system that the system treats as an internal request, bypassing authorisation checks and giving unauthorised access to sensitive data.

Proof-of-concept exploits for this vulnerability are widely and freely available.

The vulnerability, CVE-2025-29927 was fixed by Next.js in March after it was reported to the maintainers in February.

The vulnerability made it possible for requests to skip critical security checks, such as authorisation cookie validation, before accessing further routes, Next.js explained.

Versions affected include all versions of 13.x before 13.5.9; all versions of 14.x before 14.2.25, all versions of 15x before 15.2.3; and all versions from 11.1.4, up to but not inclusive of 12.3.5.

Recommended reading

• Amazon Confirms Data Breach Linked to MOVEit Vulnerability
• Report: Mitigating the Vulnerability Exploit Surge
• Report: Vulnerability Exploitation Surge Endangers Cybersecurity

“If updating to a fixed version is not feasible, the vendor has recommended that external user requests containing the “x-middleware-subrequest” header be blocked from reaching your Next.js application,” the NCSC said in its guidance. “This should be a temporary measure until updating to the latest version is possible.”

The NCSC also recommends monitoring logs for potential attacks, for example x-middleware-request headers in external requests.

According to Next.js, applications hosted on Vercel, Netlify, and deployed as static exports were not affected by the vulnerability.

Users should also ensure that they update to one of the latest fixed versions listed on the vendor’s website at their earliest opportunity.