w2hcorp/cve-2025-29927-pocHere is a simple but effective exploit for CVE-2025-29927.
This repository contains a Proof of Concept (PoC) exploit for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks by abusing a middleware-specific HTTP header.
Next.js applications often rely on middleware for authorization and access control. This CVE arises from a logic flaw in how the x-middleware-subrequest header is processed. When this header is set to middleware, the server may incorrectly assume the request originated from internal logic and bypass middleware-based auth.
This can allow attackers to access admin panels, protected APIs, or user data — with no credentials or valid session.
We provide a simple Python script to test whether a Next.js application is vulnerable.
python3 exploit.py --url https://target.com --path /admin [--proxy http://127.0.0.1:8080]
[+] Sending request to: https://target.com/admin
[+] Using header: x-middleware-subrequest: middleware
[+] Status Code: 200
[+] Response Body (first 500 chars):
<!DOCTYPE html><html><head>...You are logged in as admin...
WAF Logic:
if header 'x-middleware-subrequest' == 'middleware':
block_request()
This PoC was developed by the Offensive Security Team at W2H Corp. as part of our continuous vulnerability research efforts. The original post for the CVE explanation is here.