Vercel ι²η«ε’ε―Ή Next.js CVE-2025-29927 ηδΈ»ε¨ι²ζ€
Source: Vercel News
A security vulnerability in Next.js was responsibly disclosed, which allows malicious actors to bypass authorization in Middleware when targeting the x-middleware-subrequest header.
Vercel customers are not affected. We still recommend updating to the patched versions. Learn more about CVE-2025-29927.