Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

101–110 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#101

Post by whoknowsidont »

arandomusername wrote: post #100
whoknowsidont wrote: post #44

Earlier quoted context omitted.

Not that this isn't a serious attack vector (a possible one), but most implementations are not simply using middleware as a standalone check for authorization then blindly serving paths/content up. That'd be pretty bad architecture in any stack.

I disagree. Why pollute every function with code checking for auth if you can just do it in a middleware?

You don't do it everywhere. You do it in the source system. The Next.JS application should just be doing "sanity" checks and passing along identity information at most. That belongs in the middleware layer, but it's not authoritative.

If bypassing a middleware layer is the one "trust me bro" check you have in your web app, then lol.

That's actually really hilarious and you should tell me what company/website that's for so I can submit some bug bounties.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#102

Post by notnullorvoid »

rvz wrote: post #55

1) What. Add a single header 'x-middleware-subrequest' and it allows you to completely bypass any self-hosted Next.js middleware, including authorization. This is beyond damning. It's also exactly the reason why the whole Javascript ecosystem is really showing how immature it is and the hype and euphoria of Vercel is contributing to its clumsiness. They are now also pushing "Vibe Coding", which is a hot air hype para…

> This is beyond damning.

Absolutely agree.

> It's also exactly the reason why the whole Javascript ecosystem is really showing how immature it is and the hype and euphoria of Vercel is contributing to its clumsiness.

I would hardly say the whole JS ecosystem is immature. There's tons of mature projects that take security very seriously and are written by highly skilled programmers.

> They are now also pushing "Vibe Coding", which is a hot air hype parade, about to be brutally hit with reality when others are deploying production code that is riddled with hundreds of security vulnerabilities

There are certainly many fresh programmers entering the ecosystem and "vibe coding" among other hyped trends are able to ride that wave. It's pretty clear that those hyping it are either new themselves (don't know better), or cater to an audience of new programmers. Those in the latter group are doing it to farm engagement, and/or are really out of touch from what real software systems look like/require.

The silent majority of moderate to highly experienced JS programmers know that these LLMs produce shit code outside of boilerplate and small demos. It's very easy to tell if you try to use them on anything else.

It is concerning on many levels though that new programmers are being guided off a cliff like this. Programming influencers and companies advocating for "vibe coding" and the like should be called out for sabotaging the next generation of programmers.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#104

Post by shepherdjerred »

cromka wrote: post #99
no_wizard wrote: post #86

Earlier quoted context omitted.

Seems indicative of the companies priorities especially as of late. This has always been an issue with Vercel. I highly recommend people stay way from their stuff.

What's the next best alternative? Astro?

What do you get out of Next.js over vanilla React? I've never understood why that ecosystem is so popular.

Anyway though, Astro is lovely, especially for static site generation.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#105

Post by bawolff »

ronbenton wrote: post #54

This is a wild vuln in how trivial it is to execute. But maybe even wilder is the timeframe to event _start_ triaging the bug after it was reported. How? Was it incorrectly named? Was the severity not correctly stated? Someone help me understand how this sits for 2+ weeks. 2025-02-27T06:03Z: Disclosure to Next.js team via GitHub private vulnerability reporting 2025-03-14T17:13Z: Next.js team started triaging the repo…

If there is no evidence of in the wild exploitation and no reason to think the vulnerability is publicly known, then 2 weeks seems like an acceptable turn around time.

If you start looking at big corps, you will very quickly find instances of fairly severe vulns that sit for months before a fix is issue.

(I'm assuming "started triaging" actually means worked on fixed. If they didnt even respond to reporter for 2 weeks, that is kind of bad)

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#106

Post by _m_p »

FirmwareBurner wrote: post #30
ilrwbwrkhv wrote: post #26

Earlier quoted context omitted.

I mean their whole product is geared towards bad developers. And I don't say that loosely. I literally mean bad developers. Developers who do not understand what a product is and how learning something slightly more difficult such as servers and things of that nature that actually can make for a better product.

What product alternative to Nextjs would you say is targeted towards "good developers"?

https://www.phoenixframework.org/

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#107

Post by shepherdjerred »

ramoz wrote: post #32

VC influence in the web space has been a fascinating thing. I hope Next's downfall sends a signal to the quality lib maintainers and changes direction (e.g. Remix and a f'd up router, TanStack w/ Start). SSR frameworks make me vomit.

I feel like I missed the whole SSR wave. I've been very happy just using vanilla React.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#108

Post by shepherdjerred »

crab_galaxy wrote: post #66
koolba wrote: post #31

Earlier quoted context omitted.

What does this get you over vanilla express servicing a react front end? Is it the rest of the deploy infra? The vanilla app you can push to Heroku or any of its clones.

They’re different tools. If I were building a JS server for a backend, I’d use Express. Next gives you things like server side rendering and static site generation out of the box, and abstracts/blurs the line between server and client code through its paradigms. For better or for worse. The deploy infrastructure is quite nice. Nextjs is surprisingly low config, even if you forego the Vercel deployment route it’s not…

Is Astro a good alternative?

https://astro.build/

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#109

Post by hokumguru »

cromka wrote: post #99
no_wizard wrote: post #86

Earlier quoted context omitted.

Seems indicative of the companies priorities especially as of late. This has always been an issue with Vercel. I highly recommend people stay way from their stuff.

What's the next best alternative? Astro?

Without a doubt. It’s really good.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#110

Post by rs186 »

mattmanser wrote: post #36
whoknowsidont wrote: post #18

Earlier quoted context omitted.

HN has a very weird mind-set when it comes to JS frameworks. Next.JS is more than fine for 99% of web apps, and the fit only gets better the bigger your web app/platform. In general it's probably the framework that will give you the most bang for your buck.

That's a bold claim, that's easy to refute. Next.js is a bad choice for a lot of apps, javascript is slow at a lot of things. Next.js would be a terrible choice for any app that has any non-trivial compute, for example.

Wait, how is "JavaScript is slow at a lot of things" (a vague/questionable premise by itself) relevant to the discussion here?
Post reply on HN