Security Research

CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion

Next.js uses the x-middleware-subrequest header with recursion depth (MAX_RECURSION_DEPTH=5) to decide “is the current request a legitimate subrequest?” — attackers only need to put 5 repeated middleware paths in the header to trigger the “internal subrequest” judgment and completely skip middleware’s authentication, authorization and CSP checks.

Unlock to view this content.