rubbxalc/cve-2025-29927Functional exploit for CVE-2025-29927, a critical Next.js middleware authorization bypass. Sends crafted HTTP requests with the x-middleware-subrequest header to skip authentication checks on protected routes.
This repository contains a functional exploit for CVE-2025-29927, a critical authorization bypass vulnerability in Next.js. The flaw allows attackers to bypass middleware-based authentication and authorization checks, granting unauthorized access to protected routes.
CVE-2025-29927 is a critical vulnerability in Next.js middleware that allows attackers to bypass authentication and authorization checks by sending a specially crafted HTTP request containing the internal header x-middleware-subrequest. This header is intended or internal use to prevent infinite recursion during middleware execution. However, its improper handling allows attackers to exploit this mechanism to skip middleware checks, potentially exposing sensitive administrative routes and protected content.
The vulnerability affects Next.js versions prior to:
Applications using middleware for critical tasks, such as authentication or security checks, and running on affected versions are vulnerable to this exploit. Notably, deployments hosted on Vercel are automatically protected against this vulnerability.
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
Python 3.7+
Vulnerable Next.js application with middleware-based access control
python3 exploit.py --host <IP> --port <PORT> --path <PATH> --method <METHOD>