Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

201–210 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#201

Post by addicted »

shepherdjerred wrote: post #104
cromka wrote: post #99

Earlier quoted context omitted.

What's the next best alternative? Astro?

What do you get out of Next.js over vanilla React? I've never understood why that ecosystem is so popular. Anyway though, Astro is lovely, especially for static site generation.

> What do you get out of Next.js over vanilla React?

The biggest problem is that React itself recommends against using Vanilla React.

https://react.dev/learn/creating-a-react-app

> If you want to build a new app or website with React, we recommend starting with a framework.

This, frankly, is insane. The whole point of React was that it was this relatively lightweight UI library you could drop into pretty much any workflow.

The fact that the React docs themselves recommend against using the React library as a library is just mind boggling but also another instance in the long history of React devs being absolutely hostile to their users.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#202

Post by dbbk »

dminik wrote: post #155

Tbh the entire middleware system in Next is awful and everyone would be better off if it was scrapped and reimplemented from scratch. For starters, there's no official way to chain multiple middlewares. If you want to do multiple things, you either stuff it all into a single function or you have to implement the chaining logic yourself. Worse, the main functions (next, redirect, rewrite, ...) are static members on an…

They actually appear to be working on "Interceptors" which is what you're describing; https://github.com/vercel/next.js/pull/70961

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#203

Post by kccqzy »

tasn wrote: post #193
kccqzy wrote: post #162

Earlier quoted context omitted.

That misses the point. The OP's original use case is for a middleware to wrap a client request. The middleware would reject such multipart requests from the client.

The same way that it can reject certain headers, like it could have done in this case. It's no different, still in-band.

The middleware doesn't have to reject it. It could decide to just wrap it and pass it along. The backend code can then be able to distinguish which was sent by the client and which was added by the middleware. And that's the point. The middleware can do as little or as much filtering it desires, without causing any confusion to the backend.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#204

Post by yieldcrv »

jsheard wrote: post #43
butterlettuce wrote: post #8

Vercel’s reputation is so cooked. Jeez.

This recent post by their CEO is funny in hindsight: https://xcancel.com/rauchg/status/1901786957149032869 Hypes up AI coding, hypes up AI for security in particular, then immediately faceplants onto a critical auth bypass.

deployments on Vercel and Netlify aren't affected so the thing he is actually a CEO of is doing its job

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#205

Post by tomashertus »

dminik wrote: post #155

Tbh the entire middleware system in Next is awful and everyone would be better off if it was scrapped and reimplemented from scratch. For starters, there's no official way to chain multiple middlewares. If you want to do multiple things, you either stuff it all into a single function or you have to implement the chaining logic yourself. Worse, the main functions (next, redirect, rewrite, ...) are static members on an…

Javascript was never build for those use-cases. It should have stayed on the browser.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#206

Post by tshaddox »

ashishb wrote: post #189
tshaddox wrote: post #69

Earlier quoted context omitted.

This vulnerability has nothing to do with isomorphic code, right? Next middleware only runs on the server (or on “the edge,” which is still a server even if it’s running in a browser-esque environment).

How many frontend (full stack) guys even understand the difference?

How many people offering knee-jerk takedowns of Next.js understand the difference? Hard to say.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#207

Post by NorwegianDude »

deergomoo wrote: post #167
tshaddox wrote: post #67

Earlier quoted context omitted.

“Bypasses auth” is a weird way to put it, although everyone seems to describe it in those terms. It bypasses middleware, which is bad (and embarrassing for Vercel), but middleware shouldn’t be responsible for access control. The middleware shouldn’t be doing much more than redirecting to the sign-in page if you don’t have a session.

> redirecting to the sign-in page if you don’t have a session Is this not access control?

Yes. Yes it is. I guess this person has the same stance Vercel now has. Even Next.js docs can make up their mind of whether you should or should not do it. They reccomended it until yesteray, but then another major securityflaw was discovered that made it useless, and now they removed authentication from the docs.

The takeaway is that you should not do it. You should never use Next.js if you ever has somehting that is not supposed to be public for everyone.

No serious company uses Next.js after all the recent major security issues, at least not if they have and respect users data.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#208

Post by yawaramin »

smlx wrote: post #60

next.js has a history of similar vulnerabilities. I was made aware recently of a vulnerability that was fixed by this patch: https://github.com/vercel/next.js/pull/73482/files In this vulnerability, adding a 'x-middleware-rewrite: https://www.example.com ' header would cause the server to respond with the contents of example.com. i.e. the worlds dumbest SSRF. Note that there is no CVE for this vulnerability, nor is t…

'Next.js has published 16 security advisories since 2016' - https://nextjs.org/blog/cve-2025-29927

At first read that sounds very reasonable! But then you realize that not all vulnerabilities got a security advisory...

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#209

Post by yieldcrv »

I like NextJS and this vulnerability requires a specific self-hosting arrangement coupled with specific flag

I think this discussion is bringing a lot of unrelated angst out of the wood works that is beyond the level of rationality warranted

I think its rightful to be skeptical of Vercel’s incentives to vendor lock, and how long it took to deal with this vulnerability. Thats all independent of most of what I’m reading here

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#210

Post by c-hendricks »

tomashertus wrote: post #205
dminik wrote: post #155

Tbh the entire middleware system in Next is awful and everyone would be better off if it was scrapped and reimplemented from scratch. For starters, there's no official way to chain multiple middlewares. If you want to do multiple things, you either stuff it all into a single function or you have to implement the chaining logic yourself. Worse, the main functions (next, redirect, rewrite, ...) are static members on an…

Javascript was never build for those use-cases. It should have stayed on the browser.

JavaScript has handled the concept of middleware for decades.
Post reply on HN