zs1n/cve-2025-29927PoC | NextJS Middleware 15.2.2 - Authorization Bypass
⚠️ Critical Authentication Bypass in NextJS Middleware
🛠️ PoC implementation by @zs1n
NextJS is a popular React-based web framework, has an authentication vulnerability that affects versions prior to 12.3.5, 13.5.9, 14.2.25, and 15.2.3,this consist in the improper trust on x-middleware-subrequest header.When to spoofing this header, attackers can be bypass the middleware logic, This results in authentication and authorization mechanisms that are not normally permitted, gaining access to routes that are not permitted.
NextJS uses middleware to enforce the security policies such as authentication and authorization before routing requests. Because this header is blindly trusted by the framework, an attacker can Spoofing this header, which causes an improper handling of the middleware header, that causes effectively bypassing authentication. This lets any network user can be see o gain access to routes that are not permitted.
x-middleware-subrequest — NextJS vulnerable Header
An attacker can send a request with a spoofer x-middleware-subrequest to impersonate an internal request.
git clone https://github.com/zs1n/CVE-2025-29927
Run the exploit script CVE-2025-29927.py.
python3 CVE-2025-29927.py -u http://128.43.16.13/api/auth