Next.js Middleware Authorization Bypass (CVE-2025-29927)

What Is the Vulnerability?

In Next.js applications, middleware runs before requests reach the application, performing checks such as authentication and authorization.

In CVE-2025-29927, due to the specially added x-middleware-subrequest HTTP header, middleware may in some cases consider the request as verified. This can allow unauthorized users to access protected pages.

About the Project

In this project, I demonstrated the CVE-2025-29927 vulnerability affecting Next.js applications in a laboratory environment I created using Docker.

I built the laboratory environment from scratch myself. I prepared the login, index, and admin pages with Next.js. Then, I added authorization control to the admin page using middleware.

By intercepting HTTP requests with Burp Suite, I added the x-middleware-subrequest header and demonstrated unauthorized access to the admin page by bypassing the middleware control.

Technologies Used

• Docker
• Next.js
• Node.js
• Burp Suite Community Edition
• JavaScript

Project File Structure

.
├── pages
│   ├── admin.js
│   ├── index.js
│   └── login.js
├── middleware.js
├── Dockerfile
├── package.json
└── README.md

Requirements

The following must be installed before running the project.

• Docker Desktop
• Git
• Burp Suite Community Edition

Installation

Download the repository to your computer.

git clone https://github.com/berraesen/nextjs-middleware-auth-bypass-lab.git

Enter the folder.

cd nextjs-middleware-auth-bypass-lab

Build the Docker image.

docker build -t nextjs-auth-bypass .

Start the container.

docker run -d -p 3000:3000 --name nextjs-lab nextjs-auth-bypass

Go to the following address in your browser.

http://localhost:3000

Laboratory Structure

The project contains the following pages.

• Login
• Index
• Admin

Access to the admin page is controlled through middleware.

Testing the Vulnerability

First, try to access the /admin page via the browser.

Since you are not authorized, you will be redirected to the login page.

Intercept the request with Burp Suite.

Add the following HTTP header to the request.

x-middleware-subrequest: middleware

Send the request again.

When the middleware control is bypassed, it can be seen that the admin page can be accessed.

Expected Result

After the installation is completed;

• While middleware is functioning normally, an unauthorized user cannot access the admin page.
• When the request is modified with Burp Suite, the middleware verification can be bypassed.
• An unauthorized user can access the admin page.
• Thus, the CVE-2025-29927 vulnerability is observed in the laboratory environment.

How the Vulnerability Works

İstemci
      │
      ▼
HTTP Request
      │
      ▼
Next.js Middleware
      │
      ├──────────────► Normal Request
      │                     │
      │                     ▼
      │              Authorization Check
      │                     │
      │                     ▼
      │              Redirect to Login Page
      │
      ▼
x-middleware-subrequest
Header Added
      │
      ▼
Middleware Control Bypassed
      │
      ▼
Access to Admin Page

Prevention

To remediate this vulnerability, it is recommended that affected Next.js versions be replaced with current versions.

Additionally, authorization should not be performed only through middleware; extra authorization checks should also be applied on the server side.