Protection against Next.js CVE-2025-29927
A security vulnerability in Next.js was responsibly disclosed, which allows malicious actors to bypass authorization in Middleware when targetting the x-middleware-subrequest header.
Aaron BrownHead of Security