NCSC Urges Users to Patch Next.js Flaw Immediately

The UK NCSC warns of a critical authorization-bypass vulnerability (CVE-2025-29927) in Next.js that can allow external requests to skip middleware and authorization checks, potentially exposing sensitive data; maintainers released fixes for affected versions on March 22, proofs-of-concept are widely available, and mitigations include applying the fixed versions or blocking the x-middleware-subrequest header and monitoring logs.