nextjs-CVE-2025-29927

KO | EN

gitlite — search

#python #go #golang #android #rust #deep-learning #docker #nodejs #macos #windows #cli #vue #pytorch #openai

nextjs-CVE-2025-29927

(★ 19)

A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability

nextjs-CVE-2025-29927 Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# nextjs-CVE-2025-29927
A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability. If you want to understand exactly how this vulnerability works, you can read the original researchers excellent article [here](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware)

This template is pretty straight forward.  It does two things: First, it identifies that a website is using Next.js and then it tests to see if the target is utilizing middleware via the presence of specific response headers.  This template will identify when those two things both exist via HTTP headers. I wrote this template to help teams quickly hunt for the presence of CVE-2025-29927 in their web apps, any other use of this template is strictly discouraged.

## Disclaimer
This template will not find every application that is vulnerable to CVE-2025-29927. This template does not pass ```x-middleware-subrequest: true``` to test if the application is attackable.  Additionally, its important to note that a positive match for both does NOT mean that the application is definitely vulnerable.  If your application doesn't use middleware response headers, it won't be picked up by this template.  On the flip side, since its impossible to detect the version of Next.js that's being used, my template will identify applications as vulnerable that have already been patched.

## Install Nuclei
If you haven't used Nuclei before you can follow the instructions here: https://github.com/projectdiscovery/nuclei

## Using the nextjs-CVE-2025-29927 Nuclei template
You will probably want to add the ```-fr``` switch to enable "follow redirects".

```sh
nuclei -u https://example.com -t ./CVE-2025-29927-6mile.yaml -fr
```

![nextjs-CVE-2025-29927-pic](https://raw.githubusercontent.com/6mile/nextjs-CVE-2025-29927/main/nextjs-CVE-2025-29927-pic.png)

Use the ```-l``` argument in Nuclei to use a list of URLs in a file.

```sh
nuclei -l websites.list -t ./CVE-2025-29927-6mile.yaml -fr -silent
```

![nextjs-CVE-2025-29927-pic2](https://raw.githubusercontent.com/6mile/nextjs-CVE-2025-29927/main/nextjs-CVE-2025-29927-pic2.png)

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README