Next.js Middleware Authorization Bypass Scanner

Description

This module detects self-hosted Next.js applications affected by CVE-2025-29927, an authorization bypass in the middleware layer. Next.js tags its own internal subrequests with the x-middleware-subrequest header and skips middleware when it sees it. The header is trusted without verifying it originated internally, so an external client that supplies it causes middleware to be skipped entirely, bypassing any authentication, authorization, or redirects implemented there. Affected self-hosted versions are < 12.3.5, < 13.5.9, < 14.2.25, and < 15.2.3.

The module performs a differential check: it sends a baseline request to a user-supplied, normally middleware-gated path (expecting a redirect or a 401/403), then repeats the request with a crafted x-middleware-subrequest header. If the gate disappears (the protected resource is served, or the middleware redirect to login is gone), the target is reported vulnerable. This is detection only; the module does not act on the bypassed response.