CVE-2025-29927 PoC — Next.js 安全漏洞

Description

Next.js Middleware Authorization Bypass

介绍

# CVE-2025-29927
## Next.js Middleware Authorization Bypass

A critical vulnerability in Next.js middleware allows attackers to bypass authorization checks by manipulating the x-middleware-subrequest header. This flaw affects Next.js versions prior to 14.2.25 and 15.2.3, potentially granting unauthorized access to sensitive resources.

### References:
- [GitHub Advisory](https://github.com/advisories/GHSA-f82v-jwr5-mffw)
- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2025-29927)
- [Tenable CVE Details](https://www.tenable.com/cve/CVE-2025-29927)

### Requirements:
- [Nuclei](https://github.com/projectdiscovery/nuclei)
- CVE-2025-29927.yaml template file

### How to Run:

```sh
nuclei -t CVE-2025-29927.yaml -u <target> -headless
```

文件快照

备注