PoC-CVE-2025-29927

what is the vuln?

• this cve reports an flaw in the header x-middleware-subrequest, responsible to takes internal requests in next.js, who allow an attacker bypass the authorization middlewares in next.js 15.0.0 and acess protected routes, for example

real example

• in a webapp, there is the /dashboard route, who only logged users can acess, but, if we make the request with the heade x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware, we can access this route without authentication