1name: crowdsecurity/vpatch-CVE-2025-29927
2description: "Next.js Middleware Bypass - (CVE-2025-29927)"
3rules:
4  - and:
5      - zones:
6          - HEADERS_NAMES
7        transform:
8          - lowercase
9        match:
10          type: regex
11          value: "x-middleware-(subrequest|rewrite|next|redirect)"
12
13labels:
14  type: exploit
15  service: http
16  confidence: 3
17  spoofable: 0
18  behavior: "http:exploit"
19  label: "Next.js - Middleware Bypass"
20  classification:
21    - cve.CVE-2025-29927
22    - attack.T1595
23    - attack.T1190
24    - cwe.CWE-285
25