Wrote up a note on how the recent Next.js middleware vulnerability works https://simonwillison.net/2025/Mar/23/
![The vulnerability is best illustrated by this code snippet:
const subreq = params.request.headers['x-middleware-subrequest'];
const subrequests = typeof subreq === 'string' ? subreq.split(':') : [];
// ...
for (const middleware of this.middleware || []) {
// ...
if (subrequests.includes(middlewareInfo.name)) {
result = {
response: NextResponse.next(),
waitUntil: Promise.resolve(),
};
continue;
}
}
This was part of Next.js internals used to help avoid applying middleware recursively to requests that are re-dispatched through the framework.
Unfortunately it also meant that attackers could send a x-middleware-subrequest HTTP header with a colon-separated list of middleware names to skip. If a site used middleware to apply an authentication gate (as suggested in the Next.js documentation) an attacker could bypass that authentication using this trick.](https://cdn.masto.host/fedisimonwillisonnet/media_attachments/files/114/212/447/368/372/159/original/b26d75a87ea1f07f.jpeg)
Wrote up a note on how the recent Next.js middleware vulnerability works https://simonwillison.net/2025/Mar/23/
If you have a fediverse account, you can quote this note from your own instance. Search https://fedi.simonwillison.net/users/simon/statuses/114212447689199064 on your instance and quote it. (Note that quoting is not supported in Mastodon.)