Reading a protected Next.js page with zero credentials (CVE-2025-29927)

Exploiting CVE-2025-29927 to bypass Next.js middleware-based authentication using the x-middleware-subrequest internal header, accessing a protected internal status page without credentials.

Next.js uses an internal header to prevent middleware from running twice on subrequests. In versions before 15.2.3, an external attacker can send this header themselves to skip middleware entirely, bypassing any auth that depends on it.

Environment setup

Spin up the OopsSec Store in a new directory:

npx create-oss-store oss-store