One header skipped my Next.js middleware, and my auth with it

A Next.js advisory with a CVSS of 9.1 came out on Friday, and by Saturday morning my timeline was full of the same curl command. I spent a good part of the weekend on it, partly patching and partly fe