Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

111–120 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#111

Post by owebmaster »

FirmwareBurner wrote: post #30
ilrwbwrkhv wrote: post #26

Earlier quoted context omitted.

I mean their whole product is geared towards bad developers. And I don't say that loosely. I literally mean bad developers. Developers who do not understand what a product is and how learning something slightly more difficult such as servers and things of that nature that actually can make for a better product.

What product alternative to Nextjs would you say is targeted towards "good developers"?

nextjs is in a class of software that should not exists (backend-for-frontend). You can have an SPA and an API in any backend language/framework.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#112

Post by tbarn »

ratorx wrote: post #87
FINDarkside wrote: post #57

Earlier quoted context omitted.

That "article" looks like AI generated slop. It suggests `if (request.headers.has('x-middleware-subrequest'))` in your middleware as a fix for the problem, while the whole vulnerability is that your middleware won't be executed when that header is present.

You’re right - I was specifically referring to it giving a concrete example (which may or may not be correct) of the vulnerability as opposed to the main article just pointing in the direction of the header.

The post from the reporters is much more useful for this: https://zhero-web-sec.github.io/research-and-things/nextjs-a...

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#113

Post by DogPawHat »

urbandw311er wrote: post #4

We opted for self-hosted next.js as the architecture for the web app we are building because we believed a lot of the hype. The more comments I read about it in HN, the less comfortable I feel about this decision.

Were you using auth in middleware?

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#114

Post by ibash »

tshaddox wrote: post #67
ronbenton wrote: post #25

Oh my word: The exploit involves crafting HTTP requests containing the malicious header: GET /protected-route HTTP/1.1 Host: vulnerable-app.com x-middleware-subrequest: true So... just adding a "x-middleware-subrequest: true" header bypasses auth? Am I understanding this correctly?

“Bypasses auth” is a weird way to put it, although everyone seems to describe it in those terms. It bypasses middleware, which is bad (and embarrassing for Vercel), but middleware shouldn’t be responsible for access control. The middleware shouldn’t be doing much more than redirecting to the sign-in page if you don’t have a session.

Why shouldn’t middleware be responsible for access control?

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#115

Post by BoorishBears »

slowtrek wrote: post #80
FINDarkside wrote: post #64

Earlier quoted context omitted.

Yeah, "obvious" critical vulnerability that is easy to use against any Nextjs app, spend 2 weeks making a fix and then announce on Friday evening that all Nextjs apps are free game. Lovely. Luckily doens't affect any of the sites I'm responsible for, since I hated middleware and most of the Nextjs "magic" features already.

"Luckily doesn't affect any of the sites I'm responsible for, since I hated middleware and most of the Nextjs "magic" features already." This is probably the most important comment. You don't have to use Next.js, and if you do have to, you don't have to use everything they have in it.

I don't think that's the takeaway.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#116

Post by BoorishBears »

whoknowsidont wrote: post #93
dimgl wrote: post #81

Earlier quoted context omitted.

> React added a lot of complexity to the front end, I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. SSR has been misused widely for years and we’re now starting to see the effects of that. But there ARE great use cases for SSR. And frontend dev is the easiest it’s ever been. Run Vite Create and you have a…

Nope. Commenters here love to just state "X is over complicated!!!" when React is about the least complicated UI system across any medium there is.

Next has made React pretty complicated with RSC.

And Next itself is abandoning all reason, like implementing redirects that break if you catch exceptions (because they're exceptions) and server actions that silently fail if a network issue occurs.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#117

Post by ramoz »

shepherdjerred wrote: post #107
ramoz wrote: post #32

VC influence in the web space has been a fascinating thing. I hope Next's downfall sends a signal to the quality lib maintainers and changes direction (e.g. Remix and a f'd up router, TanStack w/ Start). SSR frameworks make me vomit.

I feel like I missed the whole SSR wave. I've been very happy just using vanilla React.

Vite has been a joy.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#118

Post by tyre »

tasn wrote: post #94
dimgl wrote: post #81

Earlier quoted context omitted.

> React added a lot of complexity to the front end, I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. SSR has been misused widely for years and we’re now starting to see the effects of that. But there ARE great use cases for SSR. And frontend dev is the easiest it’s ever been. Run Vite Create and you have a…

> I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. You're using a different frame of reference. Those people you're referring to, including gp, probably mean that frameworks add complexity to the frontend. That would include all the ones you listed.

Okay, so go before that the jQuery (should win the Nobel Peace Prize) used with vanilla JS building absolutely bonkers custom scripts all over the place.

React was a paradigm shift towards more complex frontend apps, but there was still complexity. It replaced a bunch of .erb or mustache or whatever templating that then tried to be interactive with JS layered on.

What React replaced was not less complex overall, though technically I guess it moved more of the functionality to the frontend.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#119

Post by impulser_ »

If anyone is looking for a good alternate to NextJS, try looking into Tanstack Start. It's currently Beta but it will probably be the best way to build full stack React apps when it hits 1.0 so it might be worth looking into for future apps.

You just add a plugin into Vite and gain SSR, streaming, server functions, API routes with minimal configuration. You basically just add a ssr.tsx and client.tsx file into your existing TanStack Router application and it becomes full stack with full type safe.

If you want to go back to a React SPA just remove the plugin and config it back to SPA.

I built an app with it recently and it has an amazing DX.

Best part you can literally run it anywhere. It builds for any platform with a single configuration.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#120

Post by lilnasy »

smlx wrote: post #60

next.js has a history of similar vulnerabilities. I was made aware recently of a vulnerability that was fixed by this patch: https://github.com/vercel/next.js/pull/73482/files In this vulnerability, adding a 'x-middleware-rewrite: https://www.example.com ' header would cause the server to respond with the contents of example.com. i.e. the worlds dumbest SSRF. Note that there is no CVE for this vulnerability, nor is t…

Not to mention the same critical vulnerability in Clerk's Next.js SDK, which should've been a wake up call.

https://clerk.com/changelog/2024-02-02#:~:text=Our%20solutio...

Post reply on HN