CVE-2025-29927 impact scope

[lunar quarry]

Hi!

The impact scope of the CVE 2025-29927 (https://nextjs.org/blog/cve-2025-29927) is not clear to me.
I'm in the following situation :

• I rely on Middleware for auth or security checks, which are not then validated later in my application.
• My app is hosted on Vercel.

Then I'm in the Affected and Not Affected sections. What do I conclude?

Have all a great day!

[obsidian stump]

Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

[light panther]

You are technically vulnerable but Vercel has ad hoc firewall rules in place to prevent your app from receiving the malicious requests.

[rigid bolt]

you are not affected

but you will be affected if you move the hosting to a different platform not covered under the "not affected" section

[lunar quarry]

Great. Thanks a lot! Have a great day 🙂

[obsidian stump]

✅ Success!

This question has been marked as answered! If you have any other questions, feel free to create another post

Jump to answer

[Click here](#1356555586191228999 message)

[obsidian stump]

✅ Success!

This question has been marked as answered! If you have any other questions, feel free to create another post

Jump to answer

[Click here](#1356555586191228999 message)

[lunar quarry]

Btw, how do you know all that? Is there doc about this?