nextjs-CVE-2025-29927-hunter

About

A simple Python tool that automates Shodan searches and filters target IPs/domains to identify assets potentially vulnerable to CVE-2025-29927 in Next.js deployments.

Usage

Extract both IPs and domains

python3 nextjs-CVE-2025-29927-hunter.py -t target.com

Only extract domains

python3 nextjs-CVE-2025-29927-hunter.py -t target.com -dom

Only extract IPs

python3 nextjs-CVE-2025-29927-hunter.py -t target.com -ip

Screenshot

Installation

git clone https://github.com/darklotuskdb/nextjs-CVE-2025-29927-hunter.git && cd nextjs-CVE-2025-29927-hunter && chmod +x *.py && chmod +x *.sh 

./install.sh

References

• Next.js and the corrupt middleware: the authorizing artifact
• Doing the Due Diligence: Analyzing the Next.js Middleware Bypass (CVE-2025-29927)
• I Scanned 100,000+ Subdomains For CVE-2025-29927

Support me?

BuyMeACoffee If you like my work <3

About Me

• DarkLotus - CyberSecurity Researcher - DarkLotusKDB

Social Media Handles

• Twitter
• Medium
• Linkedin
• Instagram