Next.js sites on Netlify are NOT vulnerable to CVE-2025-29927 / GHSA-f82v-jwr5-mffw

Features Updates
,
1

Summary

A critical severity security vulnerability in Next.js was just announced. This allows a malicious actor to bypass authorization middleware in certain cases. All Next.js versions earlier than 14.2.25 or 15.2.3 are theoretically affected.

Fortunately, sites on Netlify are not and have never been affected by this vulnerability.

We’ve added end-to-end tests to the OpenNext Netlify adapter validating this.

Steps to take

There is no action required from you. Sites on Netlify are not affected.

(Optional) For the “trust but verify” folks

If you want to validate this yourself on your own site, follow these steps:

  1. Add a middleware to your site like this one
  2. Deploy this change to Netlify:
netlify deploy --build
  1. Issue a request to your deployed website draft URL with the maliciously crafted request header, e.g.:
curl -I -H 'x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware' https://abc0dc7e858044204d3d6e36--your-site-here.netlify.app
  1. Confirm that you see this response header printed:
x-test-used-middleware: true

If you require additional support, please reach out.