Netskope Threat Labs

ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)

IPS-NPA

1 SID: 2061026

Detects malicious activity associated with the Next.js Middleware Authorization Bypass malware family. The underlying exploit code targets CVE-2025-29927.