Published onMarch 14, 2025Why Middleware-Only Auth in Next.js Is Still Dangerous (Lessons From the CVE-2025-29927 Bypass)next.jssecurityCVE-2025-29927 let attackers bypass Next.js middleware with a single header. If your auth lives only in middleware you were wide open. Here is what happened and how to fix it properly.
