Next.js
criticalCVSS 9.1
Middleware authorisation bypass: a crafted x-middleware-subrequest header skips middleware execution entirely.
Dampak
Route protection implemented only in middleware can be bypassed, exposing admin and API routes.
Perbaikan
Upgrade to 14.2.25, 15.2.3 or later and enforce authorisation inside each route handler.
Referensi resmi
https://nvd.nist.gov/vuln/detail/CVE-2025-29927Apakah situs Boss terdampak?
VulScan Pro mencocokkan versi komponen yang terdeteksi dengan CVE yang relevan, termasuk CVE-2025-29927.
Jalankan audit gratis