Middleware matchers reference real routes
Why it matters
A middleware matcher like /api/legacy/:path* that has no matching route files forces the runtime to execute the entire middleware function for every request that happens to hit that prefix — or worse, wastes edge-function invocations on paths that always 404. The matcher is reference-integrity at the routing-configuration layer: it declares an intent the codebase cannot honor. In high-traffic apps this inflates the edge bill and makes debugging a 404 harder because the middleware still runs first.
Severity rationale
Medium because dangling matchers waste edge invocations and obscure 404 debugging but do not break the build.
Remediation
Open middleware.ts and either remove the matcher entries that reference nonexistent paths or create the routes they gate. Keep the config.matcher array tight to paths that exist:
// middleware.ts
export const config = {
matcher: [
'/dashboard/:path*',
'/api/protected/:path*'
]
}
Remove any matcher whose path prefix has zero files under app/ or pages/.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Hallucinated References Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-hallucinations·automated