next js middleware security vulnerability