Next.js Middleware Bypass

Middleware in Next.js intercepts incoming HTTP requests and processes them before they reach the final route handler. It is commonly used for authentication & authorization (checking if a user is logged in), logging & monitoring (tracking requests for analytics), and request modification (altering headers or query parameters).

CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware. By sending a specially crafted header, attackers can bypass all middleware checks and gain unauthorized access to protected routes.

Before exploiting, you need to identify if the target is using Next.js and has vulnerable middleware. Use nuclei templates or manual probing.

Once you've identified a vulnerable target, exploit the authorization bypass to access protected routes. The vulnerability works by spoofing the x-middleware-subrequest header.

Burp Suite provides a graphical interface for testing the vulnerability. Add the malicious header to intercept and modify requests.

For mass hunting, use Shodan to find servers potentially running vulnerable Next.js. Search for the x-middleware-rewrite header which indicates Next.js is in use.

Use these dorks to discover potentially vulnerable Next.js applications through search engines.

This vulnerability has critical impact as it allows unauthorized access to any route protected by middleware. In severe cases, attackers can compromise the entire application.

Next.js has released patches for all affected versions. Update to the latest version to remediate this vulnerability.