Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-29927 — CVE-2025-29927 Exploit Checker | Kitploit
Tools/GitHubGitHub/roycampos/cve-2025-29927
Vulnerability ScannersExploitationWeb Application ExploitationInformation GatheringPenetration TestingLearning & Education
GitHubroycampos/cve-2025-29927

CVE-2025-29927

CVE-2025-29927 Exploit Checker

View Repository
411 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Next.js Middleware Bypass Checker | CVE-2025-29927

Automated Bash tool to detect Next.js applications vulnerable to the middleware bypass CVE-2025-29927, based on research by Zhero Web Security.

Requirements

  • bash
  • whatweb
  • curl

Install them on Debian/Ubuntu with:

root@kitploit:~
sudo apt install whatweb curl

Usage

Scan a single URL

root@kitploit:~
./CVE-2025-29927.sh -u https://example.com

Scan multiple URLs

Create a urls.txt file with one URL per line:

Download Tool
root@kitploit:~
https://target1.com
https://target2.com

Run:

root@kitploit:~
./nextjs_bypass_checker_v2.sh -l urls.txt

What the script does

  1. Next.js identification

    • Uses whatweb to detect the technology.
    • Tries to read /_next/static/BUILD_ID and _buildManifest.js.

  2. Middleware detection

    • Checks if the server responds with typical Next.js middleware headers.
      • X-Middleware-Rewrite
      • X-Middleware-Set-Cookie

  3. Bypass test

    • A request is made without x-middleware-subrequest and headers are detected.
    • Then the request is repeated using known vectors with that header.
    • If the headers disappear, the middleware was successfully bypassed.

Expected output

root@kitploit:~
[*] Analyzing: https://victim.com
[+] WhatWeb:
    -> Detected: Next.js[12.2.0]
[+] BUILD_ID: 3fjd92hf8
[+] Detected version: 12.2.0
[+] Middleware active (detected headers):
    X-Middleware-Rewrite: /not-found/locale=en
[+] Testing exploits:
    -> x-middleware-subrequest: middleware -> ✅ BYPASS SUCCESSFUL (headers disappeared)
    -> x-middleware-subrequest: src/middleware -> ❌ Middleware not bypassed
[*] Finished: https://victim.com

Disclaimer

This script is for educational purposes and authorized auditing only. Do not use it against targets without consent. Misuse may constitute illegal activity.

Author

  • Roy Campos Vasquez — @RoyCampos

Based on research by: Zhero Web Security