A spoofable x-middleware-subrequest header let requests skip Next. js middleware, bypassing auth. Upgrade to the patched version; don't trust middleware alone.
Source: [Dev.to](https://dev.to/emil_alander_7c/nextjs-middleware-auth-bypass-cve-2025-29927-36no)