CVE-2025-29927

소개 x-middleware-subrequest 요청 헤더를 위조하여 Next.js 미들웨어 인증 메커니즘을 우회하고, 보호된 라우트에 대한 무단 액세스를 허용합니다. 환경 구성 프로젝트 소스 코드는 P神에서 가져온 것이며, Next.js 버전은 15.2.2입니다Next.js 15.x의 경우 이 문제는 15.2.3에서 수정되었습니다. 취약점 환경 Node와 npm이 설치되어 있는지 확인하세요. 다음 명령어로 버전을 확인합니다: node -v npm -v 의존성을 설치하고 프로젝트를 시작합니다 1. 进入项目目录 cd vulenv...

next-CVE-2025-29927

CVE-2025-29927: Next.js 미들웨어의 인증 우회 Next.js에서 중요한 취약점CVE-2025-29927이 발견되어 미들웨어 로직을 우회하여 보호된 라우트에 무단 접근할 수 있습니다. 이 문제는 Next.js 버전 11.1.4부터 13.5.6, 그리고 14.x 14.2.25 또는 15.x 15.2.3에 영향을 미칩니다. 완화를 위해 최신 수정 버전14.2.25+ 또는 15.2.3+으로 업그레이드하거나, 방화벽 규칙을 적용하여 x-middleware-subrequest 헤더를 차단하세요...

nextjs-vulnerable-app

Next.js 인증 앱 NextAuth.js를 사용하여 인증을 구현하는 Next.js 애플리케이션입니다. 이 앱은 특정 페이지에 접근하려면 사용자 인증이 필요한 보호된 경로protected routes를 제공합니다. 프로젝트 구조 nextjs-auth-app ├── components │ ├── Layout.js Layout component for consistent structure │ ├── Navbar.js Navigation bar component │ └── ProtectedRoute.js Component to...

CVE-2025-29927

CVE-2025-29927 - 안전한 프로그래밍 입문을 위한 데모 00960267 배경 이것은 특정 헤더를 사용해 미들웨어를 우회할 수 있게 한 Next.js의 치명적인 취약점인 CVE-2025-29927에 대한 데모입니다. x-middleware-subrequest 헤더는 무한 미들웨어 루프를 방지하기 위해 설계되었습니다. 요청이 미들웨어에 도달할 때마다 middleware 값이 이 헤더에 추가되며, 5번 추가되면 미들웨어는 요청을 통과시킵니다...

CVE-2026-55677 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-55677 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-55677

Echo (Go framework) prior to 4.15.3 and 5.2.0 has a router vs static file handler decoding mismatch: the router uses the raw encoded path while StaticDirectoryHandler unescapes %2F to /, enabling bypass of route-level access controls to read static files without authorization. The vulnerability i...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248

The CVE-2026-41248 affects Clerk JavaScript repositories: createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by crafted requests, bypassing middleware gating and reaching downstream handlers. Affected fixes are: @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5....

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-39406

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the...

PT-2026-23075

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4 Description Hono is a Web application framework supporting various JavaScript runtimes. An inconsistency in URL decoding between the router decodeURI and serveStatic decodeURIComponent allowed protected static...

PT-2026-23096

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.19.10 Description @hono/node-server allows running the Hono application on Node.js. When using static file serving with route-based middleware protections, inconsistent URL decoding can allow protected...

CVE-2026-22031

CVE-2026-22031 affects the Fastify middleware plugin @fastify/middie (prior to 9.1.0). A vulnerability allows bypassing a middleware registered with a path prefix by using URL-encoded paths (e.g., /%61dmin). The middie engine uses path-to-regexp for matching; the regex is applied to the undecoded...

GO-2025-3672 goshs route not protected, allows command execution in github.com/patrickhener/goshs

goshs route not protected, allows command execution in github.com/patrickhener/goshs...

UBUNTU-CVE-2023-52483

In the Linux kernel, the following vulnerability has been resolved: mctp: perform route lookups under a RCU read-side lock Our current route lookups mctproutelookup and mctproutelookupnull traverse the net's route list without the RCU read lock held. This means the route lookup is subject to...