Next.js authorisation bypass in middleware subrequests
A flaw in Next.js middleware allows attackers to bypass security checks, so developers using middleware for authorisation must update their packages immediately.
What happened
A vulnerability in how Next.js handles internal headers allows requests to skip middleware checks. Attackers can craft specific headers to gain access to protected routes without proper authorisation. While Vercel-hosted applications received an automatic fix, self-hosted deployments remain vulnerable until updated.
Who is affected
This issue impacts developers running Next.js on their own servers or third-party clouds. If your application relies on middleware to verify users or protect data, you are at risk. You should check your version number against the list of affected releases to confirm your status.
Why it matters if you build with AI
AI tools often generate boilerplate code that uses middleware as a primary security layer. Because these agents might not include secondary checks at the data level, a single bypass can expose your entire database. You must ensure your security architecture includes multiple layers rather than relying on a single script.
What to do
- Update Next.js to a fixed version
- Strip x-middleware-subrequest headers at your proxy
- Add authorisation checks to your API routes
Locaas is being built to track advisories like this, check your running applications and propose the necessary updates for your approval.
Get early access