NEXT.JS MIDDLEWARE EXPLOIT: CVE-2025-29927 AUTHORIZATION BYPASS

Summary from the TLDR Web Dev newsletter

CVE-2025-29927 is a Next.js vulnerability that allows attackers to bypass middleware authorization by manipulating the `x-middleware-subrequest` header - it affects versions 11.1.4 through recent unpatched releases, though it has now been patched in Next.js version 15.2.3.