PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-29927] Postmortem on Next.js Middleware bypass

vercel.com | vulnerability | CVE-2025-29927 | #cloud-security | #vulnerability-research | #incident-response | #web-security | #vercel | #auth-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
CVE
CVE-2025-29927
Published
Collected

Related coverage

vulnerability · slcyber.io
Doing the Due Diligence: Analyzing the Next.js Middleware Bypass (CVE-2025-29927)
Assetnote performs a deep-dive analysis of the Next.js middleware authentication bypass CVE-2025-29927, covering in-the-wild exploitability.
vulnerability · projectdiscovery.io
CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis
Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne
blog · yeswehack.com
Middleware mayhem, Zoolander banter PoC, Malta to pardon hackers over ‘unfair’ charges – ethical hacker news roundup
Roundup: Next.js CVE-2025-29927 middleware auth-bypass research, OpenAI raising AI bug bounties to $100,000, a Zoolander-themed MSRC PoC video spat, and Malta's pardon plans for hackers.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
Back