How to: CVE-2025-29927 (2025-03-21)
```
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
```
- [serhalp/test-cve-2025-29927](https://github.com/serhalp/test-cve-2025-29927)
- [Ademking/CVE-2025-29927](https://github.com/Ademking/CVE-2025-29927)
- [6mile/nextjs-CVE-2025-29927](https://github.com/6mile/nextjs-CVE-2025-29927)
- [azu/nextjs-cve-2025-29927-poc](https://github.com/azu/nextjs-cve-2025-29927-poc)
- [lirantal/vulnerable-nextjs-14-CVE-2025-29927](https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927)
- [aydinnyunus/CVE-2025-29927](https://github.com/aydinnyunus/CVE-2025-29927)
- [ticofookfook/poc-nextjs-CVE-2025-29927](https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927)
- [t3tra-dev/cve-2025-29927-demo](https://github.com/t3tra-dev/cve-2025-29927-demo)
- [websecnl/CVE-2025-29927-PoC-Exploit](https://github.com/websecnl/CVE-2025-29927-PoC-Exploit)
- [MuhammadWaseem29/CVE-2025-29927-POC](https://github.com/MuhammadWaseem29/CVE-2025-29927-POC)
- [strobes-security/nextjs-vulnerable-app](https://github.com/strobes-security/nextjs-vulnerable-app)
- [RoyCampos/CVE-2025-29927](https://github.com/RoyCampos/CVE-2025-29927)
- [fourcube/nextjs-middleware-bypass-demo](https://github.com/fourcube/nextjs-middleware-bypass-demo)
- [iSee857/CVE-2025-29927](https://github.com/iSee857/CVE-2025-29927)
- [Eve-SatOrU/POC-CVE-2025-29927](https://github.com/Eve-SatOrU/POC-CVE-2025-29927)
- [arvion-agent/next-CVE-2025-29927](https://github.com/arvion-agent/next-CVE-2025-29927)
- [Oyst3r1ng/CVE-2025-29927](https://github.com/Oyst3r1ng/CVE-2025-29927)
- [lem0n817/CVE-2025-29927](https://github.com/lem0n817/CVE-2025-29927)
- [kuzushiki/CVE-2025-29927-test](https://github.com/kuzushiki/CVE-2025-29927-test)
- [ricsirigu/CVE-2025-29927](https://github.com/ricsirigu/CVE-2025-29927)
- [0xWhoknows/CVE-2025-29927](https://github.com/0xWhoknows/CVE-2025-29927)
- [elshaheedy/CVE-2025-29927-Sigma-Rule](https://github.com/elshaheedy/CVE-2025-29927-Sigma-Rule)
- [furmak331/CVE-2025-29927](https://github.com/furmak331/CVE-2025-29927)
- [phoscoder/ghost-route](https://github.com/phoscoder/ghost-route)
- [0xPb1/Next.js-CVE-2025-29927](https://github.com/0xPb1/Next.js-CVE-2025-29927)
- [jeymo092/cve-2025-29927](https://github.com/jeymo092/cve-2025-29927)
- [alihussainzada/CVE-2025-29927-PoC](https://github.com/alihussainzada/CVE-2025-29927-PoC)
- [TheresAFewConors/CVE-2025-29927-Testing](https://github.com/TheresAFewConors/CVE-2025-29927-Testing)
- [0xPThree/next.js_cve-2025-29927](https://github.com/0xPThree/next.js_cve-2025-29927)
- [0xcucumbersalad/cve-2025-29927](https://github.com/0xcucumbersalad/cve-2025-29927)
- [c0dejump/CVE-2025-29927-check](https://github.com/c0dejump/CVE-2025-29927-check)
- [maronnjapan/claude-create-CVE-2025-29927](https://github.com/maronnjapan/claude-create-CVE-2025-29927)
- [kOaDT/poc-cve-2025-29927](https://github.com/kOaDT/poc-cve-2025-29927)
- [yugo-eliatrope/test-cve-2025-29927](https://github.com/yugo-eliatrope/test-cve-2025-29927)
- [emadshanab/CVE-2025-29927](https://github.com/emadshanab/CVE-2025-29927)
- [w3shinew/CVE-2025-29927](https://github.com/w3shinew/CVE-2025-29927)
- [aleongx/CVE-2025-29927](https://github.com/aleongx/CVE-2025-29927)
- [nicknisi/next-attack](https://github.com/nicknisi/next-attack)
- [jmbowes/NextSecureScan](https://github.com/jmbowes/NextSecureScan)
- [aleongx/CVE-2025-29927_Scanner](https://github.com/aleongx/CVE-2025-29927_Scanner)
- [Nekicj/CVE-2025-29927-exploit](https://github.com/Nekicj/CVE-2025-29927-exploit)
- [Heimd411/CVE-2025-29927-PoC](https://github.com/Heimd411/CVE-2025-29927-PoC)
- [m2hcz/PoC-for-Next.js-Middleware](https://github.com/m2hcz/PoC-for-Next.js-Middleware)
- [KaztoRay/CVE-2025-29927-Research](https://github.com/KaztoRay/CVE-2025-29927-Research)
- [nocomp/CVE-2025-29927-scanner](https://github.com/nocomp/CVE-2025-29927-scanner)
- [yuzu-juice/CVE-2025-29927_demo](https://github.com/yuzu-juice/CVE-2025-29927_demo)
- [luq0x/0xMiddleware](https://github.com/luq0x/0xMiddleware)
- [AnonKryptiQuz/NextSploit](https://github.com/AnonKryptiQuz/NextSploit)
- [w2hcorp/CVE-2025-29927-PoC](https://github.com/w2hcorp/CVE-2025-29927-PoC)
- [ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927](https://github.com/ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927)
- [dante01yoon/CVE-2025-29927](https://github.com/dante01yoon/CVE-2025-29927)
- [ayato-shitomi/WebLab_CVE-2025-29927](https://github.com/ayato-shitomi/WebLab_CVE-2025-29927)
- [Kamal-418/Vulnerable-Lab-NextJS-CVE-