Next.js CVE-2025-29927 Vulnerability Scanner

A command-line security scanner for identifying publicly accessible Next.js applications that may be exposed to CVE-2025-29927.

Disclaimer

This tool is intended for authorized security testing, vulnerability assessment, research, and defensive security work.

Only scan systems that you own or have explicit permission to test.

The scanner performs external fingerprinting and, when explicitly requested, active security testing. A result reported as potentially vulnerable should not be treated as definitive proof of compromise.

Features

• Identifies websites using Next.js.
• Checks Next.js version to determine vulnerability.
• Attempts to exploit vulnerable sites (trial).
• Supports custom Chromium path for Puppeteer.
• Allows URL input from a file or command-line arguments.
• Follows redirects (optional, may cause false positives).
• Outputs results to a JSON object or a file.

Installation

Through Github

# Clone the repository
git clone https://github.com/ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927.git
cd Automated-Next.js-Security-Scanner-for-CVE-2025-29927.git

# Install dependencies
npm install

Install globally:

npm install -g nextjs-cve-2025-29927-scanner

## Usage
Run the script with different options:
```sh
node index.js -u "https://example.com" -v

Command-line Arguments

Option	Alias	Description
-u	--urls	List of URLs (space/comma-separated)
-f	--file	File containing URLs (one per line)
-c	--chrome	Path to Chromium (default: /snap/bin/chromium)
-o	--output	File to save vulnerable site results
-v	--verbose	Enables detailed output
-r	--redirect	Follows redirects (optional, may lead to false positives)
-a	--attack	Attempts exploitation (use with caution)
-w	--wordlist	Wordlist file for exploitation
-t	--headless	Runs Puppeteer in headless mode
-x	--headers	If fails to exploit will retry with different headers

Example Usages

Scan a single website

node index.js -u "https://example.com"

Scan multiple websites

node index.js -u "https://site1.com, https://site2.com"

Scan websites from a file

node index.js -f urls.txt

Save results to a file

node index.js -u "https://example.com" -o results.txt

Run in verbose mode

node index.js -u "https://example.com" -v

Attempt exploitation (use with caution!)

node index.js -u "https://example.com" -a -w wordlist.txt

Output

• Verbose Mode (-v): Detailed logs printed to the console.
• JSON Output: When -v is not set, results are printed as JSON.
• File Output (-o): Saves detected vulnerabilities to a file.

Example Output (Verbose Mode)

Analyzing: https://example.com
https://example.com is running Next.js version: 13.5.9.
Potentially vulnerable to CVE-2025-29927.

Notes

• Use at your own risk. Ensure you have permission to scan websites.
• Set the correct Chromium path if Puppeteer fails to launch.

Remediation

Upgrade to Next.js 14.2.25 or 15.2.3 or later. If upgrading is not possible, block the x-middleware-subrequest header at the WAF or server level. Patched versions: 15.2.3, 14.2.25, 13.5.9, 12.3.5

Next Steps

• Error handling and retry logic
• Get emails from website and send an automatic email to the owners of the website

License

This project is licensed under the MIT License.