Researchers raise alarm about critical Next.js vulnerability

Researchers disclosed a critical Next.js vulnerability (CVE-2025-29927, CVSS 9.1) that can bypass middleware authorization and enable content security bypass and cache poisoning; Vercel issued a patch (Next.js 15.2.3) and published advisory materials in March, and while no active exploitation has been reported, self-hosted Next.js applications using middleware remain at risk until patched.