A critical security vulnerability has been identified in the Next.js React framework, potentially allowing attackers to bypass authorization checks under specific conditions. The vulnerability, tracked as CVE-2025-29927 (rated 9.1/10), arises from the misuse of the internal x-middleware-subrequest header, which could enable requests to skip essential security checks. Next.js has patched the issue in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, urging users to update immediately. Security researcher Rachid Allam, who discovered the flaw, has released technical details, increasing the urgency of applying fixes. Websites relying solely on middleware for authorization without additional checks are particularly vulnerable, potentially exposing sensitive admin pages to unauthorized users. If patching is not possible, blocking external requests containing the x-middleware-subrequest header is advised. CTIX analysts urge any affected readers to ensure that they upgrade to the latest security patch or implement the manual workaround if the patch can’t immediately be applied.