Skip to content
Verified Next.js middleware authorization bypass via x-middleware-subrequest
REPRO-2026-00198 next · npm Auth Bypass Jul 2, 2026 .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 37m 24s
Tool calls 180
Spend $2.62
Affected >=11.1.4 <12.3.5, >=13.0.0 <13.5.9, >=14.0 <14.2.25, >=15.0 <15.2.3
Fixed in 12.3.5, 13.5.9, 14.2.25, 15.2.3
$ pruva-verify REPRO-2026-00198
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00198/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Next.js middleware authorization checks can be bypassed when an external request includes the internal x-middleware-subrequest header, causing middleware to be skipped entirely.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.