Critical Next.js Vulnerability CVE-2025-29927

A critical vulnerability in how the x-middleware-subrequest header is verified may lead to bypassing authorization in Next.js applications.

https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw

https://www.runzero.com/blog/next-js/

Microsoft Trust Signing Service Abused

Attackers abut the Microsoft Trust Signing Service, a service meant to help developers create signed software, to obtain short lived signatures for malware.

https://www.bleepingcomputer.com/news/security/microsoft-trust-signing-service-abused-to-code-sign-malware/