“Due to the old version range, this was given lower priority in our triage queue.”
One header bypassed all Next.js middleware, auth checks included. The report sat in triage for two weeks because it looked like an old version. Vercel’s own hosting was safe and self-hosted apps were not. Vercel admits it never warned Netlify or Cloudflare.