CVE-2025-29927

Next.js Vulnerability Demo CVE-2025-29927 This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest...

next-CVE-2025-29927

CVE-2025-29927: Authorization Bypass in Next.js Middleware A critical vulnerability in Next.js CVE-2025-29927 allows unauthorized access to protected routes by bypassing the middleware logic. The issue affects Next.js versions 11.1.4 to 13.5.6, and versions 14.x 14.2.25 or 15.x 15.2.3. To mitigat...

exploit-CVE-2025-29927

Exploit for CVE-2025-29927 Next.js - Authorization Bypass Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description Next.js is a React framework for building full-stack web application...

CVE-2025-29927-NextJs-Middleware-Simulation

CVE-2025-29927：Next.js 中间件授权绕过模拟 本仓库演示了 CVE-2025-29927 的利用过程，这是一个 Next.js 中的严重漏洞，允许攻击者绕过基于中间件的授权检查。该漏洞源于对内部 x-middleware-subrequest HTTP 头部处理不当，从而能够未经授权访问受保护路由。 ⚠️ 免责声明 本项目仅用于教育和研究目的。未经明确许可针对系统进行未授权使用是违法且不道德的。作者不对任何滥用此代码的行为负责。 📚 背景 CVE-2025-29927 影响以下版本之前的 Next.js： 12.3.5 13.5.9 14.2.25 15.2.3...

nextjs-middleware-bypass-demo

CVE-2025-29927 デモ 元の記事: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware セットアップ まず、開発サーバーを起動します: root@kitploit: npm i npm run dev ブラウザで http://localhost:3000 にアクセスして結果を確認してください。 バイパスの試行 curl -I http://localhost:3000 root@kitploit: HTTP/1.1 307 Temporary Redire...

nextjs-middleware-exploit

Next.js ミドルウェア脆弱性調査 CVE-2025-29927 このリポジトリは、Next.js ミドルウェア CVE-2025-29927 における重大な脆弱性 を示しています。この脆弱性はバージョン 11.1.4 から 15.1.7 に影響し、認証バイパス 、CSP バイパス 、そしてキャッシュポイズニングによる潜在的な DoS 攻撃 を可能にします。問題は x-middleware-subrequest ヘッダの処理方法に起因し、攻撃者がミドルウェアの保護メカニズムを迂回することを許します。 この概念実証は v12 の脆弱性に特化したものです。 使用方法 環境セットアップ...

0xMiddleware

CVE-2025-29927: Explotación de Middleware en Next.js Esta herramienta demuestra y automatiza la explotación de la CVE-2025-29927 , una vulnerabilidad en Next.js que permite a un atacante omitir las comprobaciones de middleware como la autenticación abusando de la cabecera interna...

Exploit for Incorrect Authorization in Vercel Next.Js

CVE-2025-29927 — Next.js Middleware Authentication Bypass...

Next.js 15.2.3 Middleware Bypass Scanner

A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the "x-middleware-subrequest" header are processed differently compared to normal requests, potentially allowing attackers to bypass authentication. This is a scanner to test version 15.2.3...

📄 Next.js 13.5.9 Middleware Bypass Scanner

This is an authorization bypass scanner for Next.js versions 13.5.9 and below. A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the "x-middleware-subrequest" header are processed differently compared to normal requests...

Exploit for Improper Authorization in Vercel Next.Js

CVE-2025-29927 — Next.js middleware authorization bypass...

Exploit for CVE-2025-29927

CVE‑2025‑29927 – Next.js Middleware Authorization Bypass O...

Exploit for CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Next.js Middleware Bypass Vulne...

Exploit for CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass PoC Overview This...

CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to ...

Next.js Middleware Authorization Bypass Scanner

This module detects self-hosted Next.js applications affected by CVE-2025-29927, an authorization bypass in the middleware layer. Next.js tags its own internal subrequests with the x-middleware-subrequest header and skips middleware when it sees it. The header is trusted without verifying it...