---
id: 9259
title: "CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis"
cve: CVE-2025-29927
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/nextjs-middleware-authorization-bypass"
published_at: "2025-03-23T19:39:15Z"
tags: ["bug-bounty"]
phying_url: "https://phying.com/item/9259"
lang: en
---

# CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

## Summary

Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **CVE:** CVE-2025-29927
- **Published:** 2025-03-23T19:39:15Z
- **Original:** https://projectdiscovery.io/blog/nextjs-middleware-authorization-bypass
- **Phying News:** https://phying.com/item/9259