When middleware carries the authorization boundary

What happened

The maintainers’ advisory identifies a way to bypass authorization performed in Next.js middleware. Vercel’s postmortem says self-hosted next start and standalone deployments were affected, and that Vercel, Netlify, Cloudflare Workers and static exports were not affected by this specific flaw.

Why it matters

A framework name alone does not establish exposure. Record the version, the runtime, the hosting path and where the protected action’s authorization check actually runs.

What was affected

The Next.js npm package next, on server runtimes where an authorization decision depended on middleware. Historical affected ranges:

• >=11.1.4 <12.3.5
• >=13.0.0 <13.5.9
• >=14.0.0 <14.2.25
• >=15.0.0 <15.2.3

The historical patch boundaries were 12.3.5, 13.5.9, 14.2.25 and 15.2.3. These are fix boundaries for this CVE, not a recommendation to install an old release today. Choose a currently supported patched version from current vendor guidance.

What to examine

1. Reconcile the deployed dependency version and hosting path with the advisory. Do not infer impact from a package name alone.
2. For an affected deployment, follow the maintainers’ patch guidance and confirm the update actually deployed.
3. In an authorized test environment, confirm that protected actions refuse unauthenticated and under-privileged synthetic users. Keep the tested routes and the exclusions explicit.

Evidence to keep

• The deployed version and runtime record
• The release identifier and deployment time
• Dated authorization test results, and the paths that were not tested

Scope and limits

This entry concerns one disclosed vulnerability. It does not establish that any particular customer was exploited or that every Next.js deployment was exposed. Historical patches were published; consult current vendor advisories before choosing an upgrade.

Control mappings: NS-AUT-01, NS-SUP-01, NS-SUP-02. Mappings organize the lesson. They do not establish that any application meets those controls.

Sources

1. Next.js maintainer advisory. Next.js. Impact, affected branches and historical patches. Reviewed 2026-10-29.
2. Vercel middleware postmortem. Vercel. Timeline, and which deployment arrangements were and were not affected. Reviewed 2026-10-29.