CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Description

Nuclei Template: CVE-2025-29927 - Next.js Middleware Authentication Bypass

Readme

# Nuclei Template: CVE-2025-29927 - Next.js Middleware Authentication Bypass
Description:
This Nuclei template detects CVE-2025-29927, a critical authentication bypass vulnerability in Next.js. The flaw allows attackers to bypass middleware-based authorization by adding a specific HTTP header (x-middleware-subrequest: middleware). This issue affects all Next.js versions before 14.2.25 and 15.2.3.

Read More: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

## How It Works
The template sends a GET request to the target URL with the malicious header.

If the response returns a 200 status code and contains protected content, the vulnerability is confirmed.

The extractor captures the response content for verification.

## Usage
Run the following command to test for the vulnerability:
```bash
nuclei -u http://10.10.137.3:3000/protected -t CVE-2025-29927.yaml
```

File Snapshot

Remarks