CVE-2025-29927: Next.js Middleware Flaw

This report describes CVE-2025-29927: an authorization bypass in Next.js Middleware where the runMiddleware function trusts and parses the x-middleware-subrequest header, allowing attackers to craft header values (including repeated entries) that bypass middleware checks and gain unauthorized access; the issue is addressed by stripping internal headers and validating the header value against a random hexadecimal string in the patch included in Next.js 15.2.3.