The vulnerability can be understood through this code snippet:

  const subreq = params.request.headers['x-middleware-subrequest'];
  const subrequests = typeof subreq === 'string' ? subreq.split(':') : [];
  // ...
  for (const middleware of this.middleware || []) {
    // ...
    if (subrequests.includes(middlewareInfo.name)) {
      result = {
        response: NextResponse.next(),
        waitUntil: Promise.resolve(),
      };
      continue;
    }
  }

Pass an x-middleware-subrequest HTTP header with a colon-separated list of middleware names to skip.

https://github.com/vercel/next.js/blob/v12.0.7/packages/next...