Data Access Layer Pattern for Next.js 16 Authentication Security

Critical Security Issue: CVE-2025-29927

Next.js 16 has a critical authentication bypass vulnerability in middleware. Middleware NextResponse.redirect() and NextResponse.rewrite() DO NOT terminate execution, allowing unauthorized access to protected resources.

The Problem

export function middleware(request: NextRequest) {
  const session = request.cookies.get('session');

  if (!session) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
}

This middleware appears to protect routes, but code after the return statement still executes. Attackers can bypass authentication by manipulating requests.