CVE-2025-29972

This PoC demonstrates an authorization bypass in Next.js by manipulating the `x-middleware-subrequest` header to skip middleware security checks. It tests for vulnerability by comparing responses with and without the header.

This PoC demonstrates an authorization bypass in Next.js by manipulating the `x-middleware-subrequest` header to skip middleware security checks. It tests for vulnerability by comparing responses with and without the header.

The repository contains a functional Python exploit for CVE-2025-29972, which bypasses Next.js middleware authorization checks by manipulating the `x-middleware-subrequest` header. The exploit sends crafted HTTP requests to test for vulnerability and checks for protected content in responses.