Postmortem on Next.js Middleware bypass

Vercel published a postmortem on CVE-2025-29927, a critical severity vulnerability in Next.js that allowed bypassing Middleware via an internal header.

The vulnerability was disclosed on February 27, 2025, and patches were released for Next.js 14.2.25 and 15.2.3 on March 17, 2025, with backports for 13.5.9 and 12.3.5 later.

Vercel confirmed that static exports, Vercel's platform, Netlify, and Cloudflare Workers were not affected due to decoupled routing.