Security Alert: How Attackers Can Bypass Next.js Middleware With a Single HTTP Header

Recently, a critical vulnerability (CVE-2025-29927) was disclosed in the popular Next.js framework, allowing attackers to circumvent middleware execution—including security checks—by leveraging an internal header.