Resources not skipped by auth middleware

Environment

  System:
    OS: macOS 15.6
    CPU: (12) arm64 Apple M4 Pro
    Memory: 702.38 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.19.0 - ~/n/bin/node
    npm: 10.9.3 - ~/n/bin/npm
  Browsers:
    Chrome: 140.0.7339.186
    Safari: 18.6
  npmPackages:
    next: 15.5.2 => 15.5.2 
    next-auth: 5.0.0-beta.29 => 5.0.0-beta.29 
    react: 19.1.0 => 19.1.0 

Reproduction URL

https://github.com/cmma0003/authentication

Describe the issue

When deploying to Vercel (I've tried also Netlify), looks like the middleware config.matcher that excludes resources files do not work. I have done everything exactly as described here, but still does not work.
middleware.ts

export { auth as middleware } from "@/lib/auth/auth";

export const config = {
    matcher: ['/((?!api/auth|_next/static|_next/image).*)'],
};

auth.ts file:

export const { handlers, signIn, signOut, auth } = NextAuth({
    providers: [
        Cognito({
            authorization: { params: { scope: "openid email profile" } },
            checks: ["pkce", "nonce"]
        }),
    ],
    pages: {
        signIn: "/signin",
    },
    callbacks: {
        authorized: async ({ auth }) => {
            return !!auth?.user;
        },
        redirect: async ({ url, baseUrl })=> {
            if (url.startsWith("/")) return `${baseUrl}${url}`;
            if (new URL(url).origin === baseUrl) return url;
            return baseUrl;
        }
    },
});

It does work properly in my local environment, what is the reason behind this issue? TIA

How to reproduce

The url where it is deployed in Vercel here: https://authentication-lake-two.vercel.app/

Expected behavior

Resources are skipped from auth, no redirection happens for them to include as part of the callback

Start with middleware.ts and auth.ts in the linked reproduction, then compare requests from the deployed Vercel URL with the local environment. Check which resource requests reach the auth middleware and how the matcher behaves in deployment. Done means the cause is identified and excluded resources no longer redirect into the authentication callback.