This vuln doesn't really have anything to do with that premise. Middleware always run on the server.