Next.js: CVE-2025-29927 Walkthrough | TryHackMe

Join me as we walkthrough how to perform a recent published next.js CVE-2025-29927. The vulnerability discovered by Rachid and Yasser Allam in Next.js, revealed that it is possible to bypass authorization checks if they occur in middleware.

Patches:
For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
For Next.js versions 11.1.4 thru 13.5.6 we recommend consulting the below workaround.

Original post: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

TryHackme Link: https://tryhackme.com/room/nextjscve202529927

If you want to share your knowledge or want to ask questions please feel to ask in the comment section. If you enjoyed or learn something please leave a like. And if you want to get notified whenever I upload please subscribe.

Incase you want to buy me a coffee, here is my buymeacoffee link|
https://buymeacoffee.com/netronsec

Видео Next.js: CVE-2025-29927 Walkthrough | TryHackMe канала NetronSec