A header you trusted because it was yours
Mitigation code available
Next.js used an internal header to mark its own subrequests, and anyone could send it. Authorisation checks made in middleware were skipped. The mitigation is a header strip at the proxy, which works because the boundary was in the wrong place to begin with.
