jmbowes/nextsecurescanNext.js CVE-2025-29927 Vulnerability Scanner
NextSecureScan is a comprehensive security scanner specifically designed to identify middleware-related authorization bypass vulnerabilities (CVE-2025-29927) in Next.js applications. This scanner leverages explicit header manipulation techniques, middleware redirect detection, and advanced polyglot bypass methods to provide thorough vulnerability assessments.
x-middleware-rewrite, x-middleware-set-cookie).x-nextjs-redirect, x-nextjs-rewrite) to assess middleware protection explicitly.X-Middleware-Subrequest header to efficiently test multiple middleware paths simultaneously.pip install requests beautifulsoup4 urllib3 colorama
Execute the scanner script and provide the URL of the Next.js application:
python nextjs_scanner.py
Then input the target URL when prompted:
Enter target URL (with or without https://): your-app-url.com
The scanner will explicitly report findings:
--------------------------------------------------------------------------------
[SCANNING] https://your-app-url.com
[INFO] Middleware redirect detected at https://your-app-url.com. Headers: ['x-nextjs-redirect']
[VULNERABLE] https://your-app-url.com middleware bypassed successfully using middleware.
--------------------------------------------------------------------------------
Scanner results should be manually verified using tools like Burp Suite or browser extensions capable of HTTP header manipulation.
X-Middleware-Subrequest) explicitly to verify bypass potential.Feel free to modify, enhance, correct, or hack the script to better suit your needs or contribute improvements back to the community. Contributions are always welcome!
This Python script is provided "as-is" without any warranties or guarantees, express or implied. The author is not responsible for any damage, loss of data, or other issues that may result from using this script. Users are encouraged to review and test the code thoroughly before using it in any critical or production environment. By using this script, you acknowledge and agree that you are doing so at your own risk and that the author bears no liability for any consequences arising from its use or misuse.