Next.js middleware-bypass/SSRF class = SATURATED/freshly-swept; "young PROGRAM" != "young/less-picked SECURITY SURFACE" (cycle276 saturation WALK)

Banked from the Vercel/Next.js CVE-2025-29927 incomplete-fix sibling hunt = WALK at the disclosure/saturation gate (no self-host spent).

The saturation map (disclosure-gate, dispositive)

• CVE-2025-29927 (Mar-2025, CVSS 9.1): middleware bypass via x-middleware-subrequest header -> skip all middleware/auth. Fixed (validate value vs random hex).
• CVE-2025-30218 (Apr-2025) = the LITERAL incomplete-fix sibling of 29927's fix: the x-middleware-subrequest-id (introduced BY the 29927 fix) was sent to third-party hosts on middleware fetch -> SSRF/header leak. Already found+fixed (12.3.6/13.5.10/14.2.26/15.2.4).
• CVE-2025-55182 / 66478 (Dec-2025): React-Flight/RSC deserialization RCE.
• May-2026 Next.js security release: 15.5.18 / 16.2.6 patch 13 ADVISORIES covering middleware bypass, SSRF, cache poisoning, XSS, DoS. The whole class freshly swept weeks ago. => The middleware/internal-header-trust/SSRF class has been hit 3+ times by top researchers + Vercel, with a 13-CVE sweep in May-2026. An undisclosed incomplete-fix sibling RIGHT NOW is very low-probability.

THE CALIBRATION (load-bearing for target selection)

A "young / less-saturated PROGRAM" (e.g. the Vercel OSS HackerOne program is relatively new + pays) is NOT the same as a "young / less-picked SECURITY SURFACE." Next.js middleware is the MOST-researched framework-security surface of 2025-2026. The patch-diff incomplete-fix vein needs a target whose vuln CLASS is NOT already being swept by a horde of researchers + the vendor. Before picking a patch-diff target, disclosure-gate the CLASS (count recent CVEs in that class + whether the vendor just did a multi-CVE sweep): a recent N-CVE security release covering the exact class = SATURATED -> WALK-before-drill, same as the GGUF-SSTI and RAGFlow saturation kills.

Discriminator for "is this patch-diff target worth it"

GOOD patch-diff target: ONE recent authz/access CVE, the vendor point-fixed it (didn't sweep the class), the surface is broad + not horde-researched (e.g. a mid-tier app, a less-famous framework). BAD: a famous framework's headline CVE class that triggered an industry-wide research pile-on + a vendor multi-CVE sweep (Next.js middleware, Log4Shell-class, etc.) -> the siblings are gone. Mattermost was BAD for a different reason (vendor sweeps the authz class per-fix); Next.js is BAD because the RESEARCHER HORDE + vendor already swept it. Related: [[2026-06-21-cycle271-gguf-chattemplate-ssti-saturated]], [[2026-06-21-mattermost-authz-membership-selfcheck-comprehensive]], [[2026-06-21-HARDRULE-cash-gate-current-tier-not-historical]].