H-ISAC TLP White Threat Bulletin: Critical Authorization Bypass Vulnerability Announced For Next.js Middleware (CVE-2025-29927)

On March 23, 2025, a critical vulnerability in Next.js middleware was disclosed and tracked as CVE-2025-29927. The vulnerability has a critical CVSS score of 9.1 and allows attackers to bypass authorization checks by adding a specially crafted request header to HTTP requests. 

View the detailed bulletin below.