themehackers/cve-2025-29972CVE-2025-29927 is a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js middleware, potentially granting unauthorized access to sensitive areas of an application, such as admin pages or user dashboards.
CVE-2025-29927 is a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js middleware, potentially granting unauthorized access to sensitive areas of an application, such as admin pages or user dashboards.
The vulnerability arises from the improper handling of the internal x-middleware-subrequest header. By crafting requests that include this header, an attacker can bypass middleware security checks, effectively skipping authentication and authorization mechanisms.
git clone https://github.com/ThemeHackers/CVE-2025-29972
cd CVE-2025-29972
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
python3 exploit.py -h
git clone https://github.com/ThemeHackers/CVE-2025-29972
cd CVE-2025-29972
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
python3 exploit.py --hostname HOSTNAME
⚠️ Note: Ensure that your Next.js applications are always updated to the latest stable versions to prevent security risks.