Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source
https://github.com/lucaschanzx/CVE-2025-29927-PoC
Associated Vulnerability
Title:Authorization Bypass in Next.js Middleware (CVE-2025-29927)
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
File Snapshot

 [4.0K]  /data/pocs/87b5c5bdca6fdef88118d79fa1a5c2c1a8bd7a14
├── [ 664]  docker-compose.yml
├── [4.0K]  patched
│   ├── [4.0K]  app
│   │   ├── [ 488]  globals.css
│   │   ├── [ 241]  layout.tsx
│   │   ├── [ 169]  page.tsx
│   │   └── [4.0K]  private
│   │       └── [ 227]  page.tsx
│   ├── [ 645]  Dockerfile
│   ├── [ 570]  middleware.ts
│   ├── [ 156]  next.config.ts
│   ├── [ 490]  package.json
│   ├── [ 53K]  package-lock.json
│   ├── [  81]  postcss.config.mjs
│   ├── [1.4K]  README.md
│   └── [ 598]  tsconfig.json
└── [4.0K]  vulnerable
    ├── [4.0K]  app
    │   ├── [ 345]  globals.css
    │   ├── [ 241]  layout.tsx
    │   ├── [ 172]  page.tsx
    │   └── [4.0K]  private
    │       └── [ 227]  page.tsx
    ├── [ 645]  Dockerfile
    ├── [ 570]  middleware.ts
    ├── [ 156]  next.config.ts
    ├── [ 228]  next-env.d.ts
    ├── [ 512]  package.json
    ├── [ 79K]  package-lock.json
    ├── [ 135]  postcss.config.mjs
    ├── [1.4K]  README.md
    ├── [ 395]  tailwind.config.ts
    └── [ 598]  tsconfig.json

7 directories, 27 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →