CVE-2025-29927 — Next.js middleware authentication bypass

An unauthenticated attacker can bypass any Next.js middleware — including authentication — by sending a single HTTP header. Affects all self-hosted Next.js applications below the patched versions.