CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

Associated Vulnerability

Description

Nuclei Template: CVE-2025-29927 - Next.js Middleware Authentication Bypass

Readme

# Nuclei Template: CVE-2025-29927 - Next.js Middleware Authentication Bypass
Description:
This Nuclei template detects CVE-2025-29927, a critical authentication bypass vulnerability in Next.js. The flaw allows attackers to bypass middleware-based authorization by adding a specific HTTP header (x-middleware-subrequest: middleware). This issue affects all Next.js versions before 14.2.25 and 15.2.3.

Read More: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

## How It Works
The template sends a GET request to the target URL with the malicious header.

If the response returns a 200 status code and contains protected content, the vulnerability is confirmed.

The extractor captures the response content for verification.

## Usage
Run the following command to test for the vulnerability:
```bash
nuclei -u http://10.10.137.3:3000/protected -t CVE-2025-29927.yaml
```

File Snapshot

 [4.0K]  /data/pocs/eb4f0ca11935e1d0e94ad52a6c58637443b7e9d7
├── [ 890]  CVE-2025-29927.yaml
└── [ 909]  README.md

0 directories, 2 files

Remarks