POSTMORTEM ON NEXT.JS MIDDLEWARE BYPASS

Summary from the TLDR Web Dev newsletter

Vercel has published a postmortem on CVE-2025-29927, a critical vulnerability in Next.js related to Middleware bypass. The timeline outlines the vulnerability's disclosure, investigation, patching, and public announcement. The vulnerability involved an internal `x-middleware-subrequest` header and impacted self-hosted Next.js applications, but not Vercel, Netlify, or Cloudflare Workers.