id: CVE-2025-29927-HEADLESS

info:
  name: Next.js Middleware Authorization Bypass
  author: ademking
  severity: critical
  description: |
    A critical vulnerability in Next.js middleware allows attackers to bypass authorization checks by manipulating the x-middleware-subrequest header. This flaw affects Next.js versions prior to 14.2.25 and 15.2.3, potentially granting unauthorized access to sensitive resources.
  impact: |
    Unauthenticated attackers can bypass middleware authorization checks by manipulating the x-middleware-subrequest header, gaining unauthorized access to protected Next.js application routes and sensitive resources.
  remediation: |
    Upgrade to Next.js version 14.2.25, 15.2.3 or later that properly validates middleware subrequest headers.
  reference:
    - https://github.com/advisories/GHSA-f82v-jwr5-mffw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29927
    - https://www.tenable.com/cve/CVE-2025-29927
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
    epss-score: 0.99225
    epss-percentile: 0.99936
  metadata:
    vendor: vercel
    product: Next.js
    framework: node.js
  tags: cve,cve2025,headless,nextjs,vkev,passive,vuln

headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate

      - action: waitstable

      - action: script
        name: nextjs_version
        args:
          code: |
            () => {
              if (!window.next || !window.next.version) {
                return "";
              }
              return window.next.version;
            }

    extractors:
      - type: dsl
        part: nextjs_version
        dsl:
          - '"Vulnerable Next.js => " + nextjs_version'

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(nextjs_version, '>= 11.1.4', '<= 13.5.6')"
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
# digest: 4b0a00483046022100aac93e1fd57974ef6c1924e79d2f0ebd678e5f0d2279d2f1b33329fb79f3a142022100861f8b3d2b8a072773236b2d06cfdeb246fdbbafceee0c8c515b72c7bafd8dbf:922c64590222798bb761d5b6d8e72950