Authorization bypass in Middleware
Original title: Authorization Bypass in Next.js Middleware
What happens
If an application checks authorization in middleware, an attacker can get around that check and reach pages that should be blocked.
Who is affected
- Self-hosted applications that do their login or permission check in
middleware.ts. - Per the advisory, deployments hosted on Vercel are protected automatically.
Affected and fixed versions
| Affected | Fixed in |
|---|---|
>= 13.0.0, < 13.5.9 | 13.5.9 |
>= 14.0.0, < 14.2.25 | 14.2.25 |
>= 15.0.0, < 15.2.3 | 15.2.3 |
>= 12.0.0, < 12.3.5 | 12.3.5 |
What to do
- Upgrade Next.js to the fixed version for your line in the table below. Next.js 11.x has no fix; only the workaround below applies.
- If you cannot upgrade yet: at the reverse proxy or load balancer, block external requests carrying the
x-middleware-subrequestheader before they reach Next.js.
Check yourself
- Look at
middleware.ts(or.js): does it check login or permissions? - Run
npm ls nextand compare with the table below. - Check the proxy: external requests with an
x-middleware-subrequestheader must be blocked or have the header removed.
Sources
Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.