CVE-2025-29927— Authorization Bypass in Next.js Middleware
Quick assessment
Affected
vercel next.js
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Next.js是Vercel开源的一个 React 框架。 Next.js 14.2.25之前版本和15.2.3之前版本存在安全漏洞，该漏洞源于如果授权检查发生在中间件中，可能绕过授权检查。
Public Exploits 3
ExploitDB · 1
EDB-52124 [webapps]
Metasploit · 1
nextjs_middleware_auth_bypass.rb [auxiliary]
Nuclei · 1
CVE-2025-29927.yaml [template]
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-29927
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authorization Bypass in Next.js Middleware
Source: CVE Program / CVE List V5
Vulnerability Description
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Next.js 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Next.js是Vercel开源的一个 React 框架。 Next.js 14.2.25之前版本和15.2.3之前版本存在安全漏洞，该漏洞源于如果授权检查发生在中间件中，可能绕过授权检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2025-29927
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Verify Next.js CVE-2025-29927 on Netlify not vulnerable | https://github.com/serhalp/test-cve-2025-29927 | POC Details |
| 2 | Next.js Middleware Authorization Bypass | https://github.com/Ademking/CVE-2025-29927 | POC Details |
| 3 | A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability | https://github.com/6mile/nextjs-CVE-2025-29927 | POC Details |
| 4 | undefined | https://github.com/azu/nextjs-cve-2025-29927-poc | POC Details |
| 5 | None | https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927 | POC Details |
| 6 | CVE-2025-29927 Proof of Concept | https://github.com/aydinnyunus/CVE-2025-29927 | POC Details |
| 7 | None | https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927 | POC Details |
| 8 | Next.js における認可バイパスの脆弱性を再現するデモです。 | https://github.com/t3tra-dev/cve-2025-29927-demo | POC Details |
| 9 | Proof-of-Concept for Authorization Bypass in Next.js Middleware | https://github.com/websecnl/CVE-2025-29927-PoC-Exploit | POC Details |
| 10 | Authorization Bypass in Next.js Middleware | https://github.com/MuhammadWaseem29/CVE-2025-29927-POC | POC Details |
| 11 | CVE-2025-29927 lab | https://github.com/strobes-security/nextjs-vulnerable-app | POC Details |
| 12 | CVE-2025-29927 Exploit Checker | https://github.com/RoyCampos/CVE-2025-29927 | POC Details |
| 13 | Demo for Next.js middleware bypass - CVE-2025-29927 | https://github.com/fourcube/nextjs-middleware-bypass-demo | POC Details |
| 14 | Next.Js 权限绕过漏洞(CVE-2025-29927) | https://github.com/iSee857/CVE-2025-29927 | POC Details |
| 15 | CVE-2025-29927 Proof of Concept | https://github.com/Eve-SatOrU/POC-CVE-2025-29927 | POC Details |
| 16 | CVE-2025-29927 Authorization Bypass in Next.js Middleware | https://github.com/arvion-agent/next-CVE-2025-29927 | POC Details |
| 17 | Next.js Middleware Auth Bypass | https://github.com/Oyst3r1ng/CVE-2025-29927 | POC Details |
| 18 | New nuclei CVE | https://github.com/lediusa/CVE-2025-29927 | POC Details |
| 19 | None | https://github.com/lem0n817/CVE-2025-29927 | POC Details |
| 20 | CVE-2025-29927の検証 | https://github.com/kuzushiki/CVE-2025-29927-test | POC Details |
| 21 | A deliberately Next.js app, vulnerable to CVE-2025-29927, Authorization Bypass | https://github.com/ricsirigu/CVE-2025-29927 | POC Details |
| 22 | Async Python scanner for Next.js CVE-2025-29927. Uses aiohttp & aiofiles to efficiently process large URL lists, detect vulnerabilities, and save results. Features connection pooling, caching, and chunked processing for fast performance | https://github.com/0xWhoknows/CVE-2025-29927 | POC Details |
| 23 | Nuclei Template: CVE-2025-29927 - Next.js Middleware Authentication Bypass | https://github.com/tobiasGuta/CVE-2025-29927-POC | POC Details |
| 24 | Sigma Rule for CVE-2025–29927 Detection | https://github.com/elshaheedy/CVE-2025-29927-Sigma-Rule | POC Details |
| 25 | Critical vulnerability in next.js : Bypass middleware authentication | https://github.com/furmak331/CVE-2025-29927 | POC Details |
| 26 | Ghost Route detects if a Next JS site is vulnerable to the corrupt middleware bypass bug (CVE-2025-29927) | https://github.com/takumade/ghost-route | POC Details |
| 27 | None | https://github.com/memmedrehimzade/CVE-2025-29927-vuln-app | POC Details |
| 28 | None | https://github.com/0xPb1/Next.js-CVE-2025-29927 | POC Details |
| 29 | None | https://github.com/jeymo092/cve-2025-29927 | POC Details |
| 30 | PoC for CVE-2025-29927: Next.js Middleware Bypass Vulnerability. Demonstrates how x-middleware-subrequest can bypass authentication checks. Includes Docker setup for testing. | https://github.com/alihussainzada/CVE-2025-29927-PoC | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-29927
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-29927 (1)
-
Authorization Bypass in Next.js Middleware · Advisory · vercel/next.js · GitHub x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: next.js
-
CVE-2026-94484
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads -
CVE-2026-94485
Next.js: Information disclosure in Next.js App Router metada -
CVE-2026-94483
Next.js: Server-Side Request Forgery in Image Optimization -
CVE-2026-94543
Next.js: Cache poisoning of SSG and ISR pages in self-hosted -
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode conten
Same vendor: vercel
-
CVE-2026-94484
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads -
CVE-2026-94485
Next.js: Information disclosure in Next.js App Router metada -
CVE-2026-94483
Next.js: Server-Side Request Forgery in Image Optimization -
CVE-2026-94543
Next.js: Cache poisoning of SSG and ISR pages in self-hosted -
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode conten
Same weakness: CWE-285
-
CVE-2026-103858
MISP Incomplete Thread Authorization Allows Unauthorized Rea -
CVE-2026-103532
immich-app Immich Shared Link Preview access.ts checkSharedL -
CVE-2026-93547
Missing Authorization Check in Vaadin Spreadsheet Allows Cel -
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards -
CVE-2026-102846
gedelumbung HospitalManagement Configuration sistem.php simp
V. Comments for CVE-2025-29927
No comments yet