CVE-2025-29927

🕷️ Next.js CVE-2025-29927 🧑🏻‍💼 Legal Disclaimer This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware CVE-2025-29927. It is provided solely for lawful, educational, and research purposes. By accessing, using,...

nextjs-middleware-auth-bypass-lab

Next.js Middleware Authorization Bypass CVE-2025-29927 What Is the Vulnerability? In Next.js applications, middleware runs before requests reach the application, performing checks such as authentication and authorization. In CVE-2025-29927, due to the specially added x-middleware-subrequest HTTP...

CVE-2025-29927-Nextjs-Analysis

CVE-2025-29927 Next.js Analysis This repository contains a self-hosted Next.js lab environment created for analyzing CVE-2025-29927 in Docker. Overview CVE-2025-29927 is a vulnerability related to authorization checks implemented in Next.js middleware. This project was built as a local lab to...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This is a Capture The Flag CTF styled Proof of Concept for the Next.js Middleware Authorization Bypass vulnerability CVE-2025-29927. The goal is to bypass the auth middleware and retrieve the flag from the /protected route. Vulnerabilit...

cloud-middleware-dataset

Cloud Middleware Dataset This project contains cloud middleware i.e. agents installed by cloud security providers used across the major cloud service providers Azure, AWS and GCP. The cloud middleware dataset lists all agents installed by the major cloud service providers Azure, AWS, and GCP. The...

CVE-2025-29927

CVE-2025-29927 Critical - 9.1 Next.js Middleware Bypass Vulnerability Hands-On of CVE-2025-29927 vulnerability in Next.js application where the internal header x-middleware-subrequest can be used to bypass middleware authentication and restricted access. Explained Next.js use an internal header...

CVE-2025-29927-PoC

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This repository contains a Proof of Concept PoC exploit for CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass authorization checks by abusing a middleware-specific HTTP header. Overview CVE ID:...

CVE-2025-29927_Next.js_Auth_Bypass

CVE-2025-29927 - Next.js Auth Bypass PoC This is a Proof of Concept PoC in Python to detect the critical vulnerability CVE-2025-29927 that affects applications developed with Next.js , specifically when they use middleware for authorization. 📌 The vulnerability allows completely bypassing...

traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020 — Traefik StripPrefix Route-Level Auth Bypass PoC A self-contained proof of concept for CVE-2026-48020 , a route-level authentication/authorization bypass in Traefik's StripPrefix middleware caused by path normalisation happening after routing decisions are made. A request such as...

CVE-2025-29927

Next.js CVE-2025-29927 This repository contains a proof of concept for CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be exploited to bypass middleware checks such as authentication. Affected Versions Next.js 15.x 🧪 This project was tested with...

CVE-2025-29927

CVE-2025-29927 – Next.js Middleware Authorization Bypass This repository contains a functional exploit for CVE-2025-29927, a critical authorization bypass vulnerability in Next.js. The flaw allows attackers to bypass middleware-based authentication and authorization checks, granting unauthorized...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit

CVE-2025-54123 — Hoverfly Middleware API Remote Code Execution Authenticated RCE via OS Command Injection in Hoverfly ≤ 1.11.3 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-54123 CVSS Score| 9.8 — Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-78 OS...

CVE-2025-29927

Next.js Vulnerability Demo CVE-2025-29927 This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest...

NextBypass

NextBypass 🚨 Next.js Middleware Authorization Bypass Tool CVE-2025-29927 Features Exploit CVE-2025-29927 via x-middleware-subrequest header Auto-browser integration Proxy/Bookmarklet Vulnerability scanning & log analysis Network traffic monitoring Installation git clone...

cve-2025-29927-lab

This repository contains a deliberately vulnerable web application built using Next.js. It is designed to demonstrate and study the security issue known as CVE-2025-29927. The goal of this project is to help security researchers, students, and bug bounty hunters understand how the vulnerability...

CVE-2025-29927

CVE-2025-29927 - Demo for Introdcution to Secure Programming 00960267 Background This is a demo of CVE-2025-29927, a critical vulnerability in Next.js that allowed bypassing the middleware with a certain header. The header x-middleware-subrequest was intended to prevent infinite middleware loops...

vulnbox-easy-CVE-2025-29927

Man-in-the-middle This application is named Man-in-the middle because it contains a vulnerability in Next.JS middleware and the flag is in the API call. 🚀 Production Setup 1. .env.production DATABASEURL=postgresql://postgres:password@db:5432/nextauth JWTSECRET=your-production-secret 2. Build and...

nextjs-middleware-auth-bypass

Next.js App Docker Deploy This project is prepared for running a Next.js application using Docker. Build Creating a Docker image: docker build -t next-app . Run Starting the container: docker run -d --name next-app --restart always -p 3000:3000 next-app Access Access via browser: http://:3000 For...

Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. Attackers may bypass middleware by sending a crafted x-middleware-subrequest header. This template requires a baseline middleware redirect before accepting a bypass 200 response. id: CVE-2025-299...