CVE-2025-29927-NextJs-Middleware-Simulation

CVE-2025-29927: Next.js Middleware Authorization Bypass Simulation This repository demonstrates the exploitation of CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass middleware-based authorization checks. The flaw stems from improper handling of the internal...

nextjs-middleware-bypass-demo

CVE-2025-29927 Demo Original writeup: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Setup First, run the development server: npm i npm run dev Open http://localhost:3000 with your browser to see the result. Trying out the bypass curl -I http://localhost:300...

next-CVE-2025-29927

CVE-2025-29927: Bypass de autorización en el middleware de Next.js Una vulnerabilidad crítica en Next.js CVE-2025-29927 permite el acceso no autorizado a rutas protegidas al omitir la lógica del middleware. El problema afecta a las versiones 11.1.4 a 13.5.6 de Next.js, y a las versiones 14.x...

exploit-CVE-2025-29927

Exploit for CVE-2025-29927 Next.js - Authorization Bypass Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description Next.js is a React framework for building full-stack web application...

nextjs-middleware-exploit

Investigación de vulnerabilidad en middleware de Next.js CVE-2025-29927 Este repositorio demuestra una vulnerabilidad crítica en el middleware de Next.js CVE-2025-29927, que afecta a las versiones 11.1.4 hasta 15.1.7. Esta vulnerabilidad permite el bypass de autorización , el bypass de CSP y...

CVE-2025-29927

Next.js Vulnerability Demo CVE-2025-29927 This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest...

0xMiddleware

CVE-2025-29927: Next.js Middleware Exploit This tool demonstrates and automates the exploitation of CVE-2025-29927 , a vulnerability in Next.js that allows an attacker to bypass middleware checks like authentication by abusing the internal header x-middleware-subrequest. 🔧 How the Exploit Works...

Exploit for Incorrect Authorization in Vercel Next.Js

CVE-2025-29927 — Next.js Middleware Authentication Bypass...

Next.js 15.2.3 Middleware Bypass Scanner

A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the "x-middleware-subrequest" header are processed differently compared to normal requests, potentially allowing attackers to bypass authentication. This is a scanner to test version 15.2.3...

📄 Next.js 13.5.9 Middleware Bypass Scanner

This is an authorization bypass scanner for Next.js versions 13.5.9 and below. A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the "x-middleware-subrequest" header are processed differently compared to normal requests...

Exploit for Improper Authorization in Vercel Next.Js

CVE-2025-29927 — Next.js middleware authorization bypass...

Exploit for CVE-2025-29927

CVE‑2025‑29927 – Next.js Middleware Authorization Bypass O...

Exploit for CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Next.js Middleware Bypass Vulne...

Exploit for CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass PoC Overview This...

CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to ...

Next.js Middleware Authorization Bypass Scanner

This module detects self-hosted Next.js applications affected by CVE-2025-29927, an authorization bypass in the middleware layer. Next.js tags its own internal subrequests with the x-middleware-subrequest header and skips middleware when it sees it. The header is trusted without verifying it...