Web Security · Senior · Question 67 of 75
What was the core issue in the 2025 Next.js middleware vulnerability (CVE-2025-29927)?
- 1Middleware disabled HTTPS for some routes
- 2Middleware leaked environment variables into the HTML
- ✓Correct answer: An internal header could make middleware skip, so apps doing auth only in middleware could be bypassed
Explanation
The lesson: middleware is a convenient first gate, but authorization must also be checked close to the data, in route handlers, actions and data access code.