CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

https://github.com/ayato-shitomi/WebLab_CVE-2025-29927

Associated Vulnerability

Title:Authorization Bypass in Next.js Middleware (CVE-2025-29927)
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Description

Next.js Auth Bypass Lab ‐ CVE-2025-29927

Readme

# CVE-2025-29927

Next.js 15.2.2 の CVE-2025-29927 を悪用した認証バイパスラボ

## 起動

```
chmod +x ./run.sh
./run.sh
```

起動が完了したら、 http://localhost:3000/ にアクセスを行います。

File Snapshot


 [4.0K]  /data/pocs/2ba6f1dcdf8bd46a06143d779ad30f73a633316f
├── [4.0K]  ctf-nextjs-vulnerable
│   ├── [  74]  docker-compose.yaml
│   ├── [ 144]  Dockerfile
│   ├── [ 456]  middleware.ts
│   ├── [ 133]  next.config.ts
│   ├── [ 474]  package.json
│   ├── [ 35K]  package-lock.json
│   ├── [4.0K]  pages
│   │   ├── [ 257]  index.tsx
│   │   ├── [ 803]  login.tsx
│   │   └── [ 169]  secret.tsx
│   ├── [4.0K]  public
│   │   ├── [ 391]  file.svg
│   │   ├── [1.0K]  globe.svg
│   │   ├── [1.3K]  next.svg
│   │   ├── [ 128]  vercel.svg
│   │   └── [ 385]  window.svg
│   ├── [1.4K]  README.md
│   ├── [4.0K]  src
│   │   └── [4.0K]  app
│   │       ├── [ 25K]  favicon.ico
│   │       ├── [ 608]  globals.css
│   │       ├── [ 662]  layout.tsx
│   │       └── [2.7K]  page.module.css
│   └── [ 602]  tsconfig.json
├── [ 225]  README.md
└── [  61]  run.sh

5 directories, 22 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!