Postmortem on Next.js Middleware bypass

This post details a post-incident analysis of CVE-2025-29927, a critical vulnerability in Next.js Middleware. It explains the timeline of disclosure, investigation, and patching, highlighting that Vercel's platform was incidentally invulnerable due to its decoupled routing system. The technical analysis describes how the vulnerability exploited an internal `x-middleware-subrequest` header to bypass Middleware execution. Next steps include improving partner communication, streamlining security reporting, enhancing internal response processes, and establishing a partner mailing list.