nextjs-CVE-2025-29927

A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability. If you want to understand exactly how this vulnerability works, you can read the original researchers excellent article here

This template is pretty straight forward. It does two things: First, it identifies that a website is using Next.js and then it tests to see if the target is utilizing middleware via the presence of specific response headers. This template will identify when those two things both exist via HTTP headers. I wrote this template to help teams quickly hunt for the presence of CVE-2025-29927 in their web apps, any other use of this template is strictly discouraged.

Disclaimer

This template will not find every application that is vulnerable to CVE-2025-29927. This template does not pass x-middleware-subrequest: true to test if the application is attackable. Additionally, its important to note that a positive match for both does NOT mean that the application is definitely vulnerable. If your application doesn't use middleware response headers, it won't be picked up by this template. On the flip side, since its impossible to detect the version of Next.js that's being used, my template will identify applications as vulnerable that have already been patched.

Install Nuclei

If you haven't used Nuclei before you can follow the instructions here: https://github.com/projectdiscovery/nuclei

Using the nextjs-CVE-2025-29927 Nuclei template