CVE-2025-29927 impact scope
Answered
American Crocodile posted this in #help-forum
American CrocodileOP
Hi!
The impact scope of the CVE 2025-29927 (https://nextjs.org/blog/cve-2025-29927) is not clear to me.
I'm in the following situation :
- I rely on Middleware for auth or security checks, which are not then validated later in my application.
- My app is hosted on Vercel.
Then I'm in the Affected and Not Affected sections. What do I conclude?
Have all a great day!
The impact scope of the CVE 2025-29927 (https://nextjs.org/blog/cve-2025-29927) is not clear to me.
I'm in the following situation :
- I rely on Middleware for auth or security checks, which are not then validated later in my application.
- My app is hosted on Vercel.
Then I'm in the Affected and Not Affected sections. What do I conclude?
Have all a great day!
Answered by joulev
you are not affected
but you will be affected if you move the hosting to a different platform not covered under the "not affected" section
but you will be affected if you move the hosting to a different platform not covered under the "not affected" section
5 Replies
Giant panda
You are technically vulnerable but Vercel has ad hoc firewall rules in place to prevent your app from receiving the malicious requests.
@American Crocodile Hi!
The impact scope of the CVE 2025-29927 (https://nextjs.org/blog/cve-2025-29927) is not clear to me.
I'm in the following situation :
- I rely on Middleware for auth or security checks, which are not then validated later in my application.
- My app is hosted on Vercel.
Then I'm in the *Affected* and *Not Affected* sections. What do I conclude?
Have all a great day!
you are not affected
but you will be affected if you move the hosting to a different platform not covered under the "not affected" section
but you will be affected if you move the hosting to a different platform not covered under the "not affected" section
Answer
American CrocodileOP
Great. Thanks a lot! Have a great day 🙂
Btw, how do you know all that? Is there doc about this?
Spectacled bear
Article by Next - https://nextjs.org/blog/cve-2025-29927