GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware

• npm next: >= 13.0.0, < 13.5.9 → fixed in 13.5.9 • npm next: >= 14.0.0, < 14.2.25 → fixed in 14.2.25 • npm next: >= 15.0.0, < 15.2.3 → fixed in 15.2.3 • npm next: >= 12.0.0, < 12.3.5 → fixed in 12.3.5

Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. Patches • For Next.js 15.x, this issue is fixed in `15.2.3` • For Next.js 14.x, this issue is fixed in `14.2.25` • For Next.js 13.x, this issue is fixed in 13.5.9 • For Next.js 12.x, this issue is fixed in 12.3.5 • For Next.js 11.x, consult the below workaround. _Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._ Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application. Credits • Allam Rachid (zhero;) • Allam Yasser (inzo_)