# Vercel — Postmortem on Next.js Middleware bypass

- Company: Vercel (vercel.com)
- Announced: 2025-03-25T13:00:00+00:00
- Category: safety-policy-update
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://vercel.com/blog/postmortem-on-next-js-middleware-bypass
- Record: https://forck.live/items/20892-postmortem-on-next-js-middleware-bypass
- Subject: v0 / AI SDK / AI Gateway

Vercel published a postmortem on CVE-2025-29927, a critical severity vulnerability in Next.js that allowed bypassing Middleware via an internal header. The vulnerability was disclosed on February 27, 2025, and patches were released for Next.js 14.2.25 and 15.2.3 on March 17, 2025, with backports for 13.5.9 and 12.3.5 later. Vercel confirmed that static exports, Vercel's platform, Netlify, and Cloudflare Workers were not affected due to decoupled routing.

## Evidence

Verbatim from https://vercel.com/blog/postmortem-on-next-js-middleware-bypass:

> Next.js uses an internal x-middleware-subrequest header to detect and prevent recursion—and bypass the execution of Middleware.

---

Record: https://forck.live/items/20892-postmortem-on-next-js-middleware-bypass
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md