Next.js CVE-2025-29927: Why middleware should not be your only auth boundary

Short summary

Operation PCPcat exploited CVE-2025-29927 in Next.js, compromising 59,000+ servers by bypassing middleware auth via a trusted internal header (x-middleware-subrequest). The attack stole up to 590,000 credential sets in 48 hours. The key lesson: middleware is application code, not a security boundary — authorization checks must also live inside route handlers that touch sensitive data, providing defense in depth.

• •CVE-2025-29927 allowed bypassing Next.js middleware auth via a trusted header, compromising 59,000+ servers
• •Middleware is application code, not a firewall — it can be skipped or bypassed
• •Defense in depth: keep authorization checks in route handlers, not just middleware

Generated with AI, which can make mistakes.