Next.js Middleware Authorization Bypass

Description

A vulnerability in Next.js allows attackers to bypass middleware-based authorization checks by adding a specially crafted x-middleware-subrequest header to HTTP requests. This bypass completely circumvents middleware controls that are commonly used for implementing authorization, path rewriting, server-side redirects, and adding response headers such as Content Security Policy (CSP).

Remediation

Update to the latest patched version of Next.js (13.5.7+, 14.2.25+, or 15.2.3+). If immediate updating is not possible, implement additional layers of access control that don't rely solely on Next.js middleware, such as server-side validation of authentication tokens or implementing access controls at the API or database level.