CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

https://github.com/Naveen-005/Next.Js-middleware-bypass-vulnerability-CVE-2025-29927

Associated Vulnerability

Title:Authorization Bypass in Next.js Middleware (CVE-2025-29927)
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Description

A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.

Readme

 A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts. 
 Details: [Read Here](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware)


This uses Next.js version 15.2.2.
The vulnerability allows the user to bypass the middleware script which contains the verification and can access the admin page without login.
This can be done by adding the Header ```x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware``` to the request

This could be used as CTF challenge.

File Snapshot


 [4.0K]  /data/pocs/df4437c00e5469ed7d3ad3bf463527ef45b9ec3e
├── [  77]  jsconfig.json
├── [  92]  next.config.mjs
├── [ 320]  package.json
├── [ 28K]  package-lock.json
├── [4.0K]  public
│   ├── [ 391]  file.svg
│   ├── [1.0K]  globe.svg
│   ├── [1.3K]  next.svg
│   ├── [ 128]  vercel.svg
│   └── [ 385]  window.svg
├── [ 594]  README.md
└── [4.0K]  src
    ├── [4.0K]  app
    │   ├── [4.0K]  admin
    │   │   └── [ 194]  page.js
    │   ├── [4.0K]  api
    │   │   └── [4.0K]  auth
    │   │       └── [4.0K]  login
    │   │           └── [ 894]  route.js
    │   ├── [ 25K]  favicon.ico
    │   ├── [ 608]  globals.css
    │   ├── [ 567]  layout.js
    │   ├── [4.0K]  login
    │   │   └── [1.7K]  page.jsx
    │   ├── [ 774]  page.js
    │   └── [2.7K]  page.module.css
    ├── [ 243]  auth.js
    └── [1.4K]  middleware.js

8 directories, 20 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!