🛡️ CVE-2025-29927

The items that name it 3

• GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences
  article2026-10-12It is written here as CVE-2025-29927 (Next.js authentication bypass).

  Next.js authentication bypass

• Socket: Next.js Moves to Scheduled Security Releases
  article2026-07-16

  Authorization bypass in Next.js disclosed March 2025, CVSS 9.1, allowing an attacker to skip Next.js middleware (including authentication and authorization checks) by spoofing the internal x-middleware-subrequest header.

• Lonkero — Rust web vulnerability scanner (v3.7, AI agent mode)
  repo