CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis
Summary
Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne
- CVE
- CVE-2025-29927
- Published
- Collected
--- id: 9259 title: "CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis" cve: CVE-2025-29927 source_domain: projectdiscovery.io source_url: "https://projectdiscovery.io/blog/nextjs-middleware-authorization-bypass" published_at: "2025-03-23T19:39:15Z" tags: ["bug-bounty"] phying_url: "https://phying.com/item/9259" lang: en --- # CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis ## Summary Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne ## Intelligence Metadata - **Sources:** projectdiscovery.io - **CVE:** CVE-2025-29927 - **Published:** 2025-03-23T19:39:15Z - **Original:** https://projectdiscovery.io/blog/nextjs-middleware-authorization-bypass - **Phying News:** https://phying.com/item/9259