Get the latest tech news
Next.js version 15.2.3 has been released to address a security vulnerability
Next.js version 15.2.3 has been released to address a security vulnerability CVE-2025-29927.
Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops. If patching to a safe version is infeasible, it is recommended that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. GitHub Security Advisories and CVEs are industry-standard approaches to notifying users, vendors, and companies of vulnerabilities in software.
Or read this on Hacker News
