Authorization Bypass in Next.js Middleware

Next.js versions 1.11.4 through 15.2.2 allow attackers to bypass authorization checks implemented in middleware by manipulating the x-middleware-subrequest header, potentially granting unauthorized access to protected resources.

Authorization bypass in Next.js middleware occurs when an attacker crafts requests with a spoofed x-middleware-subrequest header, causing the authorization logic to be skipped or misinterpreted. This affects versions 1.11.4 to 15.2.2; the vulnerability is patched in 12.3.5, 13.5.9, 14.2.25, and 15.2.3. The attack requires network access to the application and results in circumvention of authorization controls.