knotsecurity/cve-2025-29927-nextjs-middleware-simulationSimulates CVE-2025-29927, a critical Next.js vulnerability allowing attackers to bypass middleware authorization by exploiting the internal x-middleware-subrequest HTTP header. Demonstrates unauthorized access to protected routes and provides mitigation strategies.
This repository demonstrates the exploitation of CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass middleware-based authorization checks. The flaw stems from improper handling of the internal x-middleware-subrequest HTTP header, enabling unauthorized access to protected routes.
This project is intended for educational and research purposes only. Unauthorized use against systems without explicit permission is illegal and unethical. The authors are not responsible for any misuse of this code.
CVE-2025-29927 affects Next.js versions prior to:
The vulnerability arises when an attacker includes the x-middleware-subrequest header in an HTTP request. Next.js interprets this header as an internal subrequest, causing it to skip middleware execution, including critical authorization checks.
git clone https://github.com/Knotsecurity/CVE-2025-29927-NextJs-Middleware-Simulation.git
cd cve-2025-29927-simulationnpm installnpm run dev
The application includes a protected route at /admin, which is guarded by middleware that checks for user authentication.
/login page and log in with [email protected]:password123./admin page. You will get an unauthorized access error.x-middleware-subrequest: middleware, then send the request./admin page.To protect against this vulnerability:
npm install next@latestx-middleware-subrequest header.