Middleware is no longer constrained to the Edge runtime subset. Fluid Compute gives you the full Node.js API surface while keeping the same global latency profile. Auth, feature flags, and geo-routing just got simpler.
Next.js middleware has graduated from the Edge runtime. With Fluid Compute, your middleware now runs on full Node.js, same global regions, same pricing, zero runtime restrictions.
Edge functions ran on a limited JavaScript subset. You couldn't:
crypto, fs, path)process.env in some casesFluid Compute runs standard Node.js in Vercel's edge network. Your middleware gets:
crypto, fs, zlib, everything// Now works in middleware:
import { jwtVerify } from 'jose' // uses Node crypto
const { payload } = await jwtVerify(token, secret)// AsyncLocalStorage for request-scoped context:
import { AsyncLocalStorage } from 'node:async_hooks'// Access the full geo object, no Edge-specific APIs:
const country = request.geo?.countryIf you're on Edge middleware today: your existing code keeps working. Fluid Compute is a superset. If you're starting fresh: write standard Node.js, no special runtime knowledge needed.
A coordinated security disclosure on May 6 patched 12 vulnerabilities across Next.js, including middleware bypass, XSS, and SSRF. Patches were NOT backported to 13.x or 14.x. If you haven't upgraded to 15.x or 16.x, now is the time.
1 source
Vercel replaced one cache object per target path with grouped JSONL shards, an optional inline fixed-width index, and a binary search over offsets computed at build time. If you ship a large lookup bundle, the pattern transfers; the 91% P99 cut is Vercel's own unreproduced number.
1 source
The unload event stops firing by default for 60% of page loads in Edge 152, 100% by Edge 155, so move telemetry and state-saving to pagehide or visibilitychange before your data silently vanishes.
1 source