Description
Next.js 是一个用于构建全栈 Web 应用程序的 React 框架。2025年3月，官方披露 CVE-2025-29927 Next.js 中间件权限绕过漏洞。如果授权检查发生在Next.js 中间件中，攻击者可构造恶意请求绕过相关权限校验。
Next.js X-Middleware-Subrequest 权限绕过漏洞（CVE-2025-29927）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.nsfocus.net/cve-2025-29927/
https://zhuanlan.zhihu.com/p/32498280364
https://www.cnblogs.com/CVE-Lemon/p/18797265
https://www.cc.ntu.edu.tw/chinese/epaper/home/20250620_007305.html
https://avd.aliyun.com/detail?id=AVD-2025-29927
https://cloud.tencent.com/developer/article/2612752
https://blog.csdn.net/vscode5coder/article/details/152058713
https://www.akamai.com/zh/blog/security-research/march-authorization-bypass-critical-nextjs-detections-mitigations
https://www.eavan.dev/posts/nextjs-cve-2025-29927
https://www.venustech.com.cn/new_type/aqsjxy/20250325/28468.html
https://nvd.nist.gov/vuln/detail/CVE-2025-29927
https://github.com/aydinnyunus/CVE-2025-29927
https://securitylabs.datadoghq.com/articles/nextjs-middleware-auth-bypass/
https://jfrog.com/blog/cve-2025-29927-next-js-authorization-bypass/
https://projectdiscovery.io/blog/nextjs-middleware-authorization-bypass
https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
https://nsfocusglobal.com/next-js-middleware-permission-bypass-vulnerability-cve-2025-29927/
https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-auth-bypass