CVE-2025-29927 — Next.js middleware bypass mass exploitation

A 9.1-CVSS Next.js middleware-bypass vulnerability was disclosed and patched on the same day. Vercel-hosted apps were patched automatically; self-hosted Next.js apps became target-of-the-week. One year later, 40% are still vulnerable.