Next.js middleware-only authz (CVE-2025-29927)

What it is

Authorization is enforced only in Next.js middleware, with no check inside the route handlers or server actions that middleware is protecting.

Why it matters

CVE-2025-29927 let a crafted x-middleware-subrequest header skip middleware entirely, which turned every middleware-only guard into no guard. Beyond that specific bug, a single choke point outside the handler is one routing change away from being bypassed.

How to fix it

Update Next.js to a patched release, then add the authorization check inside each protected handler and server action. Keep middleware as a fast path, not as the thing standing between a request and your data.