Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Next.js security: Middleware and Proxy are not the only authorization layer
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Optional further reading — not required for grades.
On September 14, 2026, iSyncEvolution published a CTO-oriented guide to Next.js Middleware and Proxy authorization risk. It reviews CVE-2025-29927, a critical Middleware authorization bypass (CVSS 9.1) patched in releases including 12.3.5, 13.5.9, 14.2.25, and 15.2.3, plus later 2026 Middleware/Proxy bypasses disclosed in May (App Router segment-prefetch, Pages Router i18n, dynamic route parameters) and July (certain App Router apps using Turbopack and a single i18n locale in the 16.0.x–16.2.x range).
The through-line is architectural: do not treat Middleware or, in Next.js 16, proxy.ts as the only authorization layer. The guide repeats the recommended workaround — enforce authorization in server-side page, Route Handler, Server Action, or data-access logic — and notes that renaming middleware.ts to proxy.ts is not itself a security migration.
Optional further reading for CS 4550 / CS 5610 — not required for labs or grades. This course site already uses a proxy file for request handling; that does not replace checks at protected operations. Read the original article and the linked Next.js advisories before changing lab auth.