Possible fix(deps): 34 vulnerable dependencies in package-lock.json

[begininvoke]

This might be a false positive, but demos/scichart-react-next/package-lock.json around line 2841 looked worth a second pair of eyes.

CRITICAL severity authorization bypass vulnerability in Next.js middleware allows attackers to circumvent security controls by injecting the x-middleware-subrequest header. This enables unauthorized traversal of middleware authentication/authorization checks, posing a severe risk of data exfiltration, privilege escalation, and full route compromise. Immediate upgrade to a patched version is required.

Something like this might fix it:

### Primary Remediation: Upgrade Next.js
Execute: npm install next@14.2.25

Diff:
--- a/package.json
+++ b/package.json
@@ -3,5 +3,5 @@
   "dependencies": {
-    "next": "14.0.2",
+    "next": "^14.2.25",
     ...
   }
 }

### Fallback Mitigation (if immediate upgrade is not feasible):
Block the exploit header at the edge/middleware layer to prevent bypass attempts.

Diff:
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,6 +1,13 @@
 import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
 
-export default function middleware() { /* existing checks */ }
+export default function middleware(req: NextRequest) {
+  // Prevent external requests from masquerading as internal subrequests
+  if (req.headers.get('x-middleware-subrequest')) {
+    return new NextResponse(null, { status: 403 });
+  }
+  // retain original authorization logic below
+  return NextResponse.next();
+}

For reference: rule CVE-2025-29927. Rated critical.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.