{"id":62594,"date":"2025-04-09T05:55:46","date_gmt":"2025-04-09T02:25:46","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/next-js-middleware-15-2-2-authorization-bypass\/"},"modified":"2025-04-09T05:55:46","modified_gmt":"2025-04-09T02:25:46","slug":"next-js-middleware-15-2-2-authorization-bypass","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/next-js-middleware-15-2-2-authorization-bypass\/","title":{"rendered":"Next.js Middleware 15.2.2 – Authorization Bypass"},"content":{"rendered":"

<\/p>\n

\n
# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
\n# Date: 2025-03-26
\n# Exploit Author: kOaDT
\n# Vendor Homepage: https:\/\/nextjs.org\/
\n# Software Link: https:\/\/github.com\/vercel\/next.js
\n# Version: 13.0.0 - 13.5.8 \/ 14.0.0 - 14.2.24 \/ 15.0.0 - 15.2.2 \/ 11.1.4 - 12.3.4
\n# Tested on: Ubuntu 22.04.5 LTS
\n# CVE: CVE-2025-29927
\n# PoC: https:\/\/raw.githubusercontent.com\/kOaDT\/poc-cve-2025-29927\/refs\/heads\/main\/exploit.js
\n# POC GitHub Repository: https:\/\/github.com\/kOaDT\/poc-cve-2025-29927\/tree\/main\n            <\/code><\/pre>\n<\/p><\/div>\n
\u0622\u0641\u0627\u0642 \u0647\u0627\u0633\u062a\u06cc\u0646\u06af \u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631 \u0645\u0634\u0627\u0648\u0631 \u0648 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646 \u0641\u0646\u06cc <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
 # Date: 2025-03-26
 # Exploit Author: kOaDT
 # Vendor Homepage: https:\/\/nextjs.org\/
 # Software Link: https:\/\/github.com\/vercel\/next.js
 # Version: 13.0.0 – 13.5.8 \/ 14.0.0 – 14.2.24 \/ 15.0.0 – 15.2.2 \/ 11.1.4 – 12.3.4
 # Tested on: Ubuntu 22.04.5 LTS
 # CVE: CVE-2025-29927
 # PoC: https:\/\/raw.githubusercontent.com\/kOaDT\/poc-cve-2025-29927\/refs\/heads\/main\/exploit.js
 # POC GitHub …<\/p>\n","protected":false},"author":1,"featured_media":62562,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-62594","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/62594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=62594"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/62594\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media\/62562"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=62594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=62594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=62594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}