the edge runtime does not support Node.js crypto module, only in middleware Edge Runtime

Swap jsonwebtoken for jose and the error goes away. jose is built on Web Crypto, which the edge runtime does have, and verify looks like this:

import { jwtVerify } from 'jose'
const secret = new TextEncoder().encode(process.env.JWT_SECRET)
const { payload } = await jwtVerify(token, secret)

The deeper fix is the import chain. @/lib/auth almost certainly also pulls in your database client and a password hashing library, and middleware runs on every matched request including static assets if your matcher is sloppy. Make a separate lib/auth-edge.ts that contains only cookie reading and token verification, import that from middleware, and keep the fat one for route handlers.

Recent Next versions have experimental support for running middleware on the Node runtime, which would make the error go away without changing your imports. I would still not reach for it here - opting middleware into Node means your redirect for anonymous users now pays a Node cold start on the path of every request, which is a worse trade than replacing one JWT library.

Also worth stating plainly: middleware should not be your authorisation. Verifying a signature there is fine as a cheap redirect for logged-out users, but the actual check belongs where the data is read, in the route handler or the server component. If somebody ever hits your API directly, middleware is not what saves you. Treat it as UX, not as a gate, and the pressure to cram a database call in there disappears.

If you use Auth.js, this is exactly what the split config exists for: an auth.config.ts with providers and callbacks but no adapter, imported by middleware, and the full auth.ts with the database adapter imported everywhere else. The adapter is what drags a Node-only driver into the edge bundle. Took me an embarrassingly long time to notice the docs had already solved my problem.

Check your matcher while you are in there. The default example matches everything except a few static paths, and people paste it and then add a database call. Narrow it to the routes that genuinely need the redirect and the whole class of problem gets smaller.

"It does not knowingly touch crypto" is doing a lot of work in a sentence that ends with jsonwebtoken.