Skip to content

[GHSA-f82v-jwr5-mffw] Authorization Bypass in Next.js Middleware #6431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Jinz426 wants to merge 1 commit into from
Closed

[GHSA-f82v-jwr5-mffw] Authorization Bypass in Next.js Middleware #6431

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions advisories/github-reviewed/2025/03/GHSA-f82v-jwr5-mffw/GHSA-f82v-jwr5-mffw.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f82v-jwr5-mffw",
"modified": "2025-10-13T15:32:07Z",
"modified": "2025-10-13T15:32:09Z",
"published": "2025-03-21T15:20:12Z",
"aliases": [
"CVE-2025-29927"
Expand All @@ -10,8 +10,8 @@
"details": "# Impact\nIt is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.\n\n# Patches\n* For Next.js 15.x, this issue is fixed in `15.2.3`\n* For Next.js 14.x, this issue is fixed in `14.2.25`\n* For Next.js 13.x, this issue is fixed in 13.5.9\n* For Next.js 12.x, this issue is fixed in 12.3.5\n* For Next.js 11.x, consult the below workaround.\n\n_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._\n\n# Workaround\nIf patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.\n\n## Credits\n\n- Allam Rachid (zhero;)\n- Allam Yasser (inzo_)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"
Copy link

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CVSS v4.0 score is severely incorrect and misrepresents the vulnerability severity. The new score indicates:

  • Physical access required (AV:P) when this is a network-based vulnerability
  • No impact on confidentiality, integrity, or availability (all metrics set to N) when this is an authorization bypass with high impact
  • High privileges required (PR:H) when the original correctly identified this requires no privileges

This vulnerability allows bypassing authorization checks via network requests with a specific header. The original CVSS v3.1 score (9.1 CRITICAL) correctly reflected this. The new score would rate near 0.0, which is completely inconsistent with the vulnerability description stating it "is possible to bypass authorization checks."

The CVSS v4.0 score should maintain high impact ratings for confidentiality and integrity, network attack vector, and low/no privilege requirements to accurately represent this authorization bypass vulnerability.

Suggested change
"score": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/S:U/SC:N/SI:N/SA:N"

Copilot uses AI. Check for mistakes.
}
],
"affected": [
Expand Down Expand Up @@ -143,7 +143,7 @@
"CWE-285",
"CWE-863"
],
"severity": "CRITICAL",
"severity": "LOW",
Copy link

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The severity downgrade from "CRITICAL" to "LOW" is incorrect and inconsistent with the vulnerability description. This is an authorization bypass vulnerability that allows external users to bypass authorization checks in Next.js middleware by adding a specific header to their requests. Such vulnerabilities typically warrant CRITICAL or HIGH severity ratings due to their potential for unauthorized access to protected resources.

The severity should remain "CRITICAL" (or at minimum "HIGH") to match the actual risk posed by this authorization bypass vulnerability. A "LOW" severity rating significantly understates the security risk and could lead to delayed patching by affected users.

Suggested change
"severity": "LOW",
"severity": "CRITICAL",

Copilot uses AI. Check for mistakes.
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T15:20:12Z",
"nvd_published_at": "2025-03-21T15:15:42Z"
Expand Down
Loading