CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

https://github.com/Ademking/CVE-2025-29927

Associated Vulnerability

Title: Authorization Bypass in Next.js Middleware (CVE-2025-29927)
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Description

Next.js Middleware Authorization Bypass

Readme

# CVE-2025-29927
## Next.js Middleware Authorization Bypass

A critical vulnerability in Next.js middleware allows attackers to bypass authorization checks by manipulating the x-middleware-subrequest header. This flaw affects Next.js versions prior to 14.2.25 and 15.2.3, potentially granting unauthorized access to sensitive resources.

### References:
- [GitHub Advisory](https://github.com/advisories/GHSA-f82v-jwr5-mffw)
- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2025-29927)
- [Tenable CVE Details](https://www.tenable.com/cve/CVE-2025-29927)

### Requirements:
- [Nuclei](https://github.com/projectdiscovery/nuclei)
- CVE-2025-29927.yaml template file

### How to Run:

```sh
nuclei -t CVE-2025-29927.yaml -u <target> -headless
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →