Next.js and the corrupt middleware: the authorizing artifact

IntroductionRecently, Yasser Allam, known by the pseudonym inzo_, and I, decided to team up for some research. We discussed potential targets and chose to begin by focusing on Next.js (130K stars on github, currently downloaded + 9,4 million times per week), a framework I know quite well and with which I already have fond memories, as evidenced by my previous work. Therefore, the “we” throughout t

[gabill]

「middlewareもうちょっと高度なことができると嬉しいんだけどなぁ。edgeのメリットとかどうでもいいからさぁ」と思ってたけど、逆に高度なことができなくて助かった

[efcl]

Next.jsのCVE-2025-29927の詳細