Tagged “web”

Next.js middleware authorization bypass via x-middleware-subrequest

A crafted x-middleware-subrequest header lets an attacker skip Next.js middleware execution entirely, bypassing authentication/authorization checks implemented in middleware.