fourcube

metadata:
    language: v2-beta
    name: "CVE-2025-29927 - Next.js middleware bypass"
    description: "Checks for differences in responses when using different x-middleware-subrequest header paths"
    author: "Chris Grieger - blueredix.com"
    tags: "next.js", "middleware"

run for each:
    middleware_value = "pages/_middleware",
                       "middleware",

fourcube

{
  "Name": "Block_CVE-2025-29927",
  "Priority": 0,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "Block_CVE-2025-29927"

fourcube

module.exports = class Foo {
  constructor() {
    console.log('foo');
  }
}

fourcube

 package main
    
import (
    "io"
    "log"
    "net"
)
    
func EchoServer(addr string, done chan struct{}) net.Listener {
	listener, err := net.Listen("tcp", addr)

fourcube

Use Case 1: (Target) Title (Type)
=================================
**Primary Actor**: User
**Scope**: Software system
**Level**: Summary / User Goal

Main success scenario:
----------------------
1. ...
2. ...

fourcube

'use strict';

var status = "Embedding Gists works perfectly."; 
console.log(status);

fourcube

package svv;

import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import org.junit.runner.RunWith;

import static org.mockito.Mockito.*;

fourcube

package svv;


import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import org.junit.runner.RunWith;
import org.mockito.Mock;
import org.mockito.runners.MockitoJUnitRunner;

fourcube

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */

package de.grieger.ws11_mockito;

import java.io.Reader;
import java.util.Map;