CVE-2025-29927 — Next.js

Key facts

CVE-2025-29927 (Vercel) is a Critical vulnerability: Next.js. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2025-29927
Severity	Critical
Vendor	Vercel
Product	Next.js
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-29927/

Details

CVE-2025-29927 (Vercel) is a Critical vulnerability: Next.js. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Next.js - Middleware Authorization Bypass

Overview

Field	Value
CVE ID	CVE-2025-29927
Severity	Critical (CVSS 9.1)
Vendor	Vercel
Product	Next.js
Vulnerability Type	Authorization Bypass
Exploitation	Remote, No Authentication

Description

Next.js middleware contains an authorization bypass vulnerability that allows attackers to bypass authentication and authorization checks by manipulating the x-middleware-subrequest header. This vulnerability affects applications using Next.js middleware for security controls.

Affected Versions

• Next.js 11.1.4 and later
• Next.js 12.x (all versions)
• Next.js 13.x before 13.5.6
• Next.js 14.x before 14.2.15
• Next.js 15.x before 15.2.3

Impact

• Authentication bypass
• Authorization bypass
• Access to protected routes
• Admin panel access
• Data exposure

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-29927
• https://github.com/vercel/next.js/security/advisories/

Disclaimer

This POC is for educational and authorized security testing only.

Detection and prevention

Ready-to-deploy defensive rules for CVE-2025-29927, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2025-29927 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-29927 - Next.js Middleware Bypass Snort Detection Rules
# Severity: Critical (CVSS 9.1)

# Detect x-middleware-subrequest header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-29927 Next.js Middleware Bypass Attempt";
    flow:to_server,established;
    content:"x-middleware-subrequest"; http_header; nocase;
    classtype:web-application-attack;
    sid:2025299271;
    rev:1;
    metadata:cve CVE-2025-29927, severity critical;
)

# Detect bypass with middleware value
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-29927 Next.js Middleware Bypass - Middleware Value";
    flow:to_server,established;
    content:"x-middleware-subrequest"; http_header; nocase;
    content:"middleware"; http_header; nocase;
    classtype:web-application-attack;
    sid:2025299272;
    rev:1;
    metadata:cve CVE-2025-29927, severity critical;
)

# Detect bypass attempt to admin paths
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-29927 Next.js Admin Bypass Attempt";
    flow:to_server,established;
    content:"x-middleware-subrequest"; http_header; nocase;
    content:"/admin"; http_uri;
    classtype:web-application-attack;
    sid:2025299273;
    rev:1;
    metadata:cve CVE-2025-29927, severity critical;
)

# Detect bypass to dashboard
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-29927 Next.js Dashboard Bypass Attempt";
    flow:to_server,established;
    content:"x-middleware-subrequest"; http_header; nocase;
    content:"/dashboard"; http_uri;
    classtype:web-application-attack;
    sid:2025299274;
    rev:1;
    metadata:cve CVE-2025-29927, severity critical;
)

# Detect bypass to API routes
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-29927 Next.js API Bypass Attempt";
    flow:to_server,established;
    content:"x-middleware-subrequest"; http_header; nocase;
    content:"/api/"; http_uri;
    classtype:web-application-attack;
    sid:2025299275;
    rev:1;
    metadata:cve CVE-2025-29927, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-29927 - Next.js Middleware Bypass YARA Detection Rules
 * Severity: Critical (CVSS 9.1)
 */

rule CVE_2025_29927_Bypass_Request {
    meta:
        description = "Detects CVE-2025-29927 Next.js middleware bypass requests"
        author = "Security Research"
        date = "2025-03-21"
        cve = "CVE-2025-29927"
        severity = "critical"

    strings:
        // Bypass header
        $header1 = "x-middleware-subrequest" ascii wide nocase
        $header2 = "X-Middleware-Subrequest" ascii wide

        // Common header values
        $val1 = "middleware" ascii wide
        $val2 = "src/middleware" ascii wide
        $val3 = "pages/_middleware" ascii wide

        // HTTP methods
        $method1 = "GET " ascii wide
        $method2 = "POST " ascii wide

        // Protected paths
        $path1 = "/admin" ascii wide
        $path2 = "/dashboard" ascii wide
        $path3 = "/api/admin" ascii wide
        $path4 = "/api/protected" ascii wide

    condition:
        any of ($header*) and (any of ($val*) or any of ($path*))
}

rule CVE_2025_29927_Exploit_Tool {
    meta:
        description = "Detects tools exploiting CVE-2025-29927"
        author = "Security Research"
        date = "2025-03-21"
        cve = "CVE-2025-29927"
        severity = "high"

    strings:
        // CVE reference
        $cve = "CVE-2025-29927" ascii wide nocase

        // Tool patterns
        $tool1 = "middleware bypass" ascii wide nocase
        $tool2 = "next.js bypass" ascii wide nocase
        $tool3 = "x-middleware-subrequest" ascii wide nocase

        // Script patterns
        $script1 = "requests.get" ascii wide
        $script2 = "curl" ascii wide
        $script3 = "fetch(" ascii wide

    condition:
        $cve or (any of ($tool*) and any of ($script*))
}

rule CVE_2025_29927_HTTP_Traffic {
    meta:
        description = "Detects HTTP traffic patterns for CVE-2025-29927"
        author = "Security Research"
        date = "2025-03-21"
        cve = "CVE-2025-29927"
        severity = "critical"

    strings:
        // HTTP request with bypass header
        $http1 = /GET [^\r\n]+ HTTP\/1\.[01][\r\n]+[^\r\n]*x-middleware-subrequest/i ascii
        $http2 = /POST [^\r\n]+ HTTP\/1\.[01][\r\n]+[^\r\n]*x-middleware-subrequest/i ascii

        // Header line
        $headerline = /x-middleware-subrequest:\s*[^\r\n]+/i ascii

    condition:
        any of them
}

rule CVE_2025_29927_NextJS_Context {
    meta:
        description = "Detects Next.js context with potential bypass"
        author = "Security Research"
        date = "2025-03-21"
        cve = "CVE-2025-29927"
        severity = "medium"

    strings:
        // Next.js indicators
        $next1 = "__NEXT_DATA__" ascii wide
        $next2 = "/_next/static" ascii wide
        $next3 = "_buildManifest.js" ascii wide

        // Bypass header
        $bypass = "x-middleware-subrequest" ascii wide nocase

    condition:
        any of ($next*) and $bypass
}

:material-file-download: prevention/yara.yar

# CVE-2025-29927 - Next.js Middleware Bypass Prevention for Nginx

# Strip the malicious header
proxy_set_header x-middleware-subrequest "";

# Block requests with the bypass header
map $http_x_middleware_subrequest $block_middleware_bypass {
    default 0;
    "~.+" 1;
}

server {
    # Block bypass attempts
    if ($block_middleware_bypass) {
        return 403;
    }

    # Alternative: Log and strip
    location / {
        # Log bypass attempts
        if ($http_x_middleware_subrequest) {
            access_log /var/log/nginx/cve-2025-29927-attempts.log;
        }

        # Strip header before proxying
        proxy_set_header x-middleware-subrequest "";

        # Proxy to Next.js
        proxy_pass http://nextjs_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    # Protect admin routes with additional checks
    location /admin {
        # Deny if bypass header present
        if ($http_x_middleware_subrequest) {
            return 403;
        }

        # Additional auth check
        # auth_request /auth;

        proxy_pass http://nextjs_backend;
    }

    # Protected API routes
    location /api/admin {
        if ($http_x_middleware_subrequest) {
            return 403;
        }

        proxy_pass http://nextjs_backend;
    }
}

:material-file-download: prevention/nginx.conf

# CVE-2025-29927 - Next.js Middleware Bypass Prevention for Apache HTTPD

# Enable required modules
# LoadModule headers_module modules/mod_headers.so
# LoadModule security2_module modules/mod_security2.so
# LoadModule rewrite_module modules/mod_rewrite.so

# Strip malicious header before proxying
RequestHeader unset x-middleware-subrequest

# ModSecurity Rules
<IfModule mod_security2.c>
    # Block requests with bypass header
    SecRule REQUEST_HEADERS:x-middleware-subrequest "." \
        "id:2025299271,phase:1,deny,status:403,\
        msg:'CVE-2025-29927 Next.js Middleware Bypass Attempt',\
        logdata:'Header value: %{REQUEST_HEADERS.x-middleware-subrequest}',\
        severity:CRITICAL"

    # Additional protection for admin paths
    SecRule REQUEST_URI "@rx ^/(admin|dashboard|api/admin)" \
        "id:2025299272,phase:1,chain,deny,status:403,\
        msg:'CVE-2025-29927 Protected Path with Bypass Header'"
        SecRule REQUEST_HEADERS:x-middleware-subrequest "." ""

    # Log all middleware bypass attempts
    SecRule REQUEST_HEADERS:x-middleware-subrequest "@rx ." \
        "id:2025299273,phase:1,log,\
        msg:'CVE-2025-29927 Bypass Header Detected'"
</IfModule>

# Rewrite rules to strip header
RewriteEngine On
RewriteCond %{HTTP:x-middleware-subrequest} .+
RewriteRule ^ - [F,L]

# Protect sensitive locations
<LocationMatch "^/(admin|dashboard)">
    # Block if bypass header present
    <If "%{HTTP:x-middleware-subrequest} != ''">
        Require all denied
    </If>
</LocationMatch>

# Logging
CustomLog /var/log/httpd/nextjs-bypass.log combined env=bypass_attempt

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2025-29927?

CVE-2025-29927 (Vercel) is a Critical vulnerability: Next.js. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2025-29927?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2025-29927?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Related CVEs

Other entries for the same vendor or product:

• CVE-2024-46982 — Next.js Cache Poisoning (High (7.5))

---

For authorized security testing and research only. See the full source and NVD record.