nextjs-cve-demo

Example: Authorization Bypass in Next.js Middleware CVE-2025-29927 This Repo provides example projects demonstrating the Middleware authorization bypass vulnerability in Next.js CVE-2025-29927. This vulnerability allows unauthorized users to access protected resources. Vulnerability Overview...

CVE-2025-29927

Next.js CVE-2025-29927 This repository contains a proof of concept for CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be exploited to bypass middleware checks such as authentication. Affected Versions Next.js 15.x 🧪 This project was tested with...

EUVD-2015-7714

Malware in sbrugna...

EUVD-2016-8752

Malware in sbrugna...

EUVD-2014-8942

Malware in sbrugna...

EUVD-2009-0122

Malware in sbrugna...

EUVD-2006-0895

Malware in sbrugna...

EUVD-2017-2547

Malware in sbrugna...

EUVD-2003-0823

Malware in sbrugna...

EUVD-2020-9391

Malware in sbrugna...

EUVD-2017-18694

Malware in sbrugna...

EUVD-2008-5516

Malware in sbrugna...

EUVD-2007-3244

Malware in sbrugna...

EUVD-2016-7223

Malware in sbrugna...

EUVD-2011-4033

Malware in sbrugna...

EUVD-2023-0544

Malicious code in bioql PyPI...

EUVD-2025-6938

Malicious code in bioql PyPI...

EUVD-2024-1586

Malicious code in bioql PyPI...

Server-Side Request Forgery (SSRF)

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the improper use of the next function without explicitly passing the request object, which allows an attacker to exploit incorrectly forwarded user-supplied headers in self-hosted applications...

CVE-2025-32094

An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai...