Authorization bypass in Next.js middleware

GHSA-f82v-jwr5-mffw — Next.js versions prior to 15.2.3 and 14.2.25 trusted the x-middleware-subrequest request header unconditionally, without verifying its origin.

An attacker could forge this header to skip auth middleware entirely, gaining access to protected routes and API endpoints that should have been gated behind authentication checks.

The patch replaced blind header trust with cryptographic session validation. The new code generates a random session ID on internal requests using crypto.getRandomValues(), then verifies this value before trusting any subrequest header.

This ensures that only requests originating from Next.js internal routing can set the subrequest header — external attackers cannot forge it.