CVE-2025-29927 Next.js Analysis

This repository contains a self-hosted Next.js lab environment created for analyzing CVE-2025-29927 in Docker.

Overview

CVE-2025-29927 is a vulnerability related to authorization checks implemented in Next.js middleware. This project was built as a local lab to observe middleware-protected route behavior in a controlled environment.

Documentation

• Analysis report: docs/CVE-2025-29927-Analysis-Report.md
• Screenshots: docs/images/
• PoC script: poc.sh

Environment

• Next.js
• Docker
• Middleware-protected /admin route

Quick Start

1. Git Clone

git clone https://github.com/sangrok-jeon/CVE-2025-29927-Nextjs-Analysis.git
cd CVE-2025-29927-Nextjs-Analysis

2. Lab Setup

cd JSR-next15
docker build -t nextjs .
docker run --rm -p 3000:3000 nextjs

Then open:

• /
• /admin

3. PoC Execution

chmod +x poc.sh
./poc.sh

If needed, you can pass a custom target URL:

./poc.sh http://localhost:3000/admin

4. Alternative Docker Compose

docker compose -f JSR-next15/docker-compose.yml up -d --build

Project Structure

.
|-- JSR-next15/
|   |-- Dockerfile
|   |-- docker-compose.yml
|   |-- middleware.js
|   |-- package.json
|   |-- package-lock.json
|   |-- public/
|   `-- src/
|-- docs/
|   |-- CVE-2025-29927-Analysis-Report.md
|   `-- images/
|-- poc.sh
`-- README.md

Run

cd JSR-next15
docker build -t nextjs .
docker run --rm -p 3000:3000 nextjs

Notes

• This project was created for local lab testing and analysis.
• The repository includes a minimal Next.js environment under JSR-next15/ for middleware behavior validation.
• The detailed report and reproduction screenshots are included in docs/.

Author

Created by JSR for security research and lab-based CVE analysis.

Disclaimer

This repository is intended for authorized security research and educational purposes only. Do not use it against systems without explicit permission.