AUTHENTICATION BYPASS IN NEXT.JS

Summary from the TLDR InfoSec newsletter

Next.js has disclosed a Critical (9.1/10) auth bypass vulnerability. Next.js uses an internal header, X-middleware-subrequest, to prevent infinite loops from recursive requests. The vulnerability allowed users to abuse the header, bypassing middleware checks, including authorization.