This Week in Security: IngressNightmare, NextJS, and Leaking DNA - This week, researchers from Wiz Research released a series of vulnerabilities in t... - https://hackaday.com/2025/03/28/this-week-in-security-ingressnightmare-nextjs-and-leaking-dna/ #thisweekinsecurity #ingressnightmare #hackadaycolumns #securityhacks #23andme #nextjs #news
Hackaday · This Week In Security: IngressNightmare, NextJS, And Leaking DNAThis week, researchers from Wiz Research released a series of vulnerabilities in the Kubernetes Ingress NGINX Controller that, when chained together, allow an unauthorized attacker to completely t…
Critical Flaw in Next.js lets Attackers bypass Authorization.
![[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops," Next.js said in an advisory. "It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes."
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️](https://nerdculture.de/system/media_attachments/files/114/234/341/495/174/533/original/d2d061af71c4a9f2.jpeg "[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
\"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops,\" Next.js said in an advisory. \"It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes.\"
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️")
] Trying to modernize your Symfony setup? This new guide shows how to decouple your frontend using Next.js—for better performance, faster deploys, and dev workflow wins.
Next.js has patched a critical vulnerability that lets attackers bypass auth middleware in self-hosted apps. Immediate action is necessary: patch now. 
