Next.js middleware authentication bypass (CVE-2025-29927), LFI for credential extraction, and Terraform provider override for root.