Next.js is a web development framework developed by Vercel to simplify the creation of high-performance web applications. Built on top of React, Next.js extends React’s capabilities by adding several features, such as static site generation (SSG) and server-side rendering (SSR). SSG pre-generates pages at build time, allowing faster delivery to users; moreover, SSR renders pages at request time, reducing load time. In brief, Next.js added features to improve performance and user experience.

CVE-2025-29927, a recent vulnerability discovered by Rachid and Yasser Allam in Next.js, revealed that it is possible to bypass authorisation checks if they occur in middleware. Middleware is the part that grants developers control over incoming requests. It acts as a bridge between the incoming request and the routing system. The routing system is file-based, i.e., routes are created and managed by organising files and directories. This vulnerability allows attackers to bypass middleware-based authorisation, and all versions before 14.2.25 and 15.2.3 are prone to this vulnerability.

Next.js is widely used across various types of applications, including e-commerce platforms, news apps, documentation sites, and interactive web apps. Consequently, this vulnerability can have dire consequences and requires administrators to upgrade their installations to a patched version.

In this room, we will explore how to exploit and detect this vulnerability.

This room uses a few tools without teaching them from scratch. If any of them are new to you, spend a little time with the Burp Suite, Snort, Zeek, and a basic Linux room first or afterward: Burp Suite for the intercepting proxy in Task 2, Snort and Zeek for the detection rules in Task 3, and Linux for the terminal commands. You can still finish this room without them, since every step is shown.