A newly discovered critical security vulnerability in the Next.js framework, designated CVE-2025-29927, poses a significant threat to web applications by allowing malicious actors to completely bypass authorization mechanisms. 

This vulnerability arises from improper handling of the x-middleware-subrequest header within Next.js middleware execution, potentially exposing sensitive administrative areas and protected resources to unauthorized access.

The vulnerability affects multiple versions of the popular React-based web framework, with different exploitation techniques depending on the specific version in use. 

Key Takeaways
1. CVE-2025-29927 exploits x-middleware-subrequest to bypass Next.js authorization.
2. Attackers set the header to middleware names to skip checks.
3. Grants unauthorized access, so implement layered security.

Security researchers have demonstrated that attackers can manipulate HTTP headers to circumvent authentication and authorization controls, gaining access to restricted areas without proper credentials.

Next.js Framework Vulnerability

NullSecurityX reports that the core of this vulnerability lies in Next.js’s middleware processing logic, specifically how it handles the x-middleware-subrequest header. 

This header was originally designed to prevent infinite middleware loops by identifying internal subrequests. However, flawed implementation allows external requests to abuse this mechanism.

The vulnerable code pattern follows this structure:

When an attacker includes the appropriate x-middleware-subrequest header value in their HTTP request, the middleware incorrectly identifies it as an internal subrequest and skips authorization checks entirely. The exploitation varies across Next.js versions:

Version 12.2 and Earlier: Attackers use x-middleware-subrequest: pages/_middleware to bypass middleware located in the pages directory.

Version 12.2 and Later: The header value changes to x-middleware-subrequest: middleware for middleware files named middleware.ts.

Version 13.2.0 and Later: Despite recursion depth protections, the fundamental vulnerability persists through repeated middleware names in the header.

Practical exploitation scenarios demonstrate the severity of this vulnerability. Attackers can craft simple HTTP requests to access protected administrative panels.

This request bypasses middleware protection and grants unauthorized access to admin functionality. 

The vulnerability becomes particularly dangerous when combined with JSON Web Token (JWT) or cookie-based authentication systems, where the header manipulation allows complete circumvention of token validation.

Automated exploitation tools can systematically test multiple protected routes simultaneously. 

Security researchers have developed proof-of-concept scripts that iterate through common administrative endpoints (/admin, /dashboard, /settings) while injecting the malicious header, quickly identifying vulnerable access points across entire applications.

The vulnerability’s impact extends beyond simple authorization bypass. In applications that rely solely on Next.js middleware for security controls, attackers can potentially access sensitive user data, modify application configurations, or execute administrative functions without proper authentication. 

Organizations running Next.js applications should immediately assess their middleware implementations and apply available security patches.

This discovery highlights the critical importance of defense-in-depth security strategies, where authorization controls exist at multiple application layers rather than relying solely on middleware-based protection mechanisms.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Critical Next.js Framework Vulnerability Let Attackers Bypass Authorization appeared first on Cyber Security News.

MediaTek today published a critical security bulletin addressing several vulnerabilities across its latest modem chipsets, urging device OEMs to deploy updates immediately. 

The bulletin, issued two months after confidential OEM notification, confirms that no known in-the-wild exploits have been detected to date.

Key Takeaways
1. MediaTek patched high- and medium-severity modem and firmware bugs across 60+ chipsets.
2. OEMs received fixes in July; update Modem NR and BSP now.
3. No exploitation detected.

High-Severity Out-of-Bounds Flaws

Three high-severity Common Vulnerability Scoring System version 3.1 (CVSS v3.1)–rated flaws affect the Modem firmware on dozens of MediaTek chipsets.

CVE-2025-20708: An out-of-bounds write (CWE-787) in the Modem’s buffer‐validation logic permits remote privilege escalation when a user equipment (UE) connects to a rogue base station. 

No user interaction is required to trigger the vulnerability. Affected chipsets include MT6813, MT6833, MT6855, MT8873, MT8893, and over 60 more models running Modem NR15–NR17R software versions.

CVE-2025-20703: An out-of-bounds read (CWE-125) in the same Modem component allows remote denial-of-service under similar conditions and with no user interaction. 

Impacted silicon spans MT2735, MT6789, MT6893, MT8678, MT8791T, MT8883, among others, all on NR15–NR17R releases.

CVE-2025-20704: A second out-of-bounds write (CWE-787) stemming from a missing bounds check can also yield remote privilege escalation, though user interaction is required for exploitation. 

The flaw targets a subset of chipsets—MT6835T, MT6899, MT6991, MT8676, MT8792, and a dozen more—running Modem NR17 and NR17R builds.

Medium-Severity Memory Corruption Flaws

Three medium-severity use-after-free bugs (CWE-416) reside in the monitor_hang, mbrain, and geniezone modules of the chipset firmware:

CVE-2025-20705 (“monitor_hang uaf”): A use-after-free error could enable local privilege escalation for attackers who already possess System privileges. 

A broad range of chipsets from MT2718 to MT8796 across Android 13–16, OpenWRT 19.07/21.02, and Yocto 2.6 releases are affected.

CVE-2025-20706 (“mbrain uaf”): Similar memory corruption in the mbrain task scheduler on MT6899, MT6989, MT6991, MT8676, and MT8678 running Android 14–15 may lead to local code execution.

CVE-2025-20707 (“geniezone uaf”): A flaw in the geniezone service can result in memory corruption under local privilege conditions on MT2718, MT6853, MT8792, MT8883, and other models across Android 13–15.

All vulnerabilities were discovered via external security research, except CVE-2025-20704, which was identified by internal validation teams. 

OEM partners have received patches since July, and final firmware images incorporating these fixes will begin rolling out immediately. 

MediaTek reminds integrators to upgrade Modem NR and Android BSP versions to mitigate risks.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post MediaTek Security Update – Patch for Multiple Vulnerabilities Across Chipsets appeared first on Cyber Security News.