Next.js: CVE-2025-29927
Explore an authorisation bypass vulnerability in Next.js.
easy
To access material, start machines and answer questions login.
Next.js is a web development framework developed by Vercel to simplify the creation of high-performance web applications. Built on top of React, Next.js extends React’s capabilities by adding several features, such as static site generation (SSG) and server-side rendering (SSR). SSG pre-generates pages at build time, allowing faster delivery to users; moreover, SSR renders pages at request time, reducing load time. In brief, Next.js added features to improve performance and user experience.
-2025-29927 (opens in new tab), a recent vulnerability discovered by Rachid and Yasser Allam (opens in new tab) in Next.js, revealed that it is possible to bypass authorisation checks if they occur in middleware. Middleware is the part that grants developers control over incoming requests. It acts as a bridge between the incoming request and the routing system. The routing system is file-based, i.e., routes are created and managed by organising files and directories. This vulnerability allows attackers to bypass middleware-based authorisation, and all versions before 14.2.25 and 15.2.3 are prone to this vulnerability.
Next.js is widely used across various types of applications, including e-commerce platforms, news apps, documentation sites, and interactive web apps. Consequently, this vulnerability can have dire consequences and requires administrators to upgrade their installations to a patched version.
In this room, we will explore how to exploit and detect this vulnerability.
Let’s exploit a demo app in the next task.
Ready to learn Cyber Security?
The Next.js: CVE-2025-29927 room is only available for Premium or Max subscribers. Signup now to access more than 500 free rooms and learn cyber security through a fun, interactive learning environment.
Already have an account? Log in