id: CVE-2025-29927-HEADLESS

info:
  name: Next.js Middleware Authorization Bypass
  author: ademking
  severity: critical
  description: |
    A critical vulnerability in Next.js middleware allows attackers to bypass authorization checks by manipulating the x-middleware-subrequest header. This flaw affects Next.js versions prior to 14.2.25 and 15.2.3, potentially granting unauthorized access to sensitive resources.
  reference:
    - https://github.com/advisories/GHSA-f82v-jwr5-mffw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29927
    - https://www.tenable.com/cve/CVE-2025-29927
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
    epss-score: 0.93584
    epss-percentile: 0.99830
  metadata:
    vendor: vercel
    product: Next.js
    framework: node.js
  tags: cve,cve2025,headless,nextjs

headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate

      - action: waitstable

      - action: script
        name: nextjs_version
        args:
          code: |
            () => {
              if (!window.next || !window.next.version) {
                return "";
              }
              return window.next.version;
            }

    extractors:
      - type: dsl
        part: nextjs_version
        dsl:
          - '"Vulnerable Next.js => " + nextjs_version'

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(nextjs_version, '>= 11.1.4', '<= 13.5.6')"
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
# digest: 4a0a00473045022100ac16c24521b6360ac31bb606cdd5d22561a0167e15754eaaeec4787f65c638ba02206be9686219a9c2c21158e2e62acd2880dd2cbe0e89fba4180e1d9a9c1504d7c1:922c64590222798bb761d5b6d8e72950