Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

61–70 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#61

Post by dontlaugh »

jsheard wrote: post #34
ratorx wrote: post #17

I found a different article that goes into more detail: https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-a... This looks trivially easy to bypass. More generally, the entire concept of using middleware which communicates using the same mechanism that is also used for untrusted user input seems pretty wild to me. It divorces the place you need to write code for user request validation (as soon as the user re…

> More generally, the entire concept of using middleware which communicates using the same mechanism that is also used for untrusted user input seems pretty wild to me. That's basically the same way phone phreaking worked back in the day. Time is a flat circle.

Somehow people never learn to avoid in-band signalling.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#62

Post by bdangubic »

whoknowsidont wrote: post #44
bdangubic wrote: post #33

Earlier quoted context omitted.

expect you know, when you can bypass auth by adding an http header :)

Not that this isn't a serious attack vector (a possible one), but most implementations are not simply using middleware as a standalone check for authorization then blindly serving paths/content up. That'd be pretty bad architecture in any stack.

you probably need to re-define “most” :)

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#63

Post by whoknowsidont »

apsurd wrote: post #49
whoknowsidont wrote: post #44

Earlier quoted context omitted.

Not that this isn't a serious attack vector (a possible one), but most implementations are not simply using middleware as a standalone check for authorization then blindly serving paths/content up. That'd be pretty bad architecture in any stack.

so having "some protections" like db foreign key scoping that mitigates "well anyone can now bypass auth middleware for any route" makes this… "not that bad on nextjs part" no no, this is absolutely nuts.

Some of you are ready for an argument, you responded to my post yet seemingly missed the very first sentence fragment:

>Not that this isn't a serious attack vector

At no point did I say or imply what you put in quotes.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#64

Post by FINDarkside »

ronbenton wrote: post #54

This is a wild vuln in how trivial it is to execute. But maybe even wilder is the timeframe to event _start_ triaging the bug after it was reported. How? Was it incorrectly named? Was the severity not correctly stated? Someone help me understand how this sits for 2+ weeks. 2025-02-27T06:03Z: Disclosure to Next.js team via GitHub private vulnerability reporting 2025-03-14T17:13Z: Next.js team started triaging the repo…

Yeah, "obvious" critical vulnerability that is easy to use against any Nextjs app, spend 2 weeks making a fix and then announce on Friday evening that all Nextjs apps are free game. Lovely. Luckily doens't affect any of the sites I'm responsible for, since I hated middleware and most of the Nextjs "magic" features already.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#65

Post by actualwitch »

ashishb wrote: post #39

Next.js is based on a fundamentally flawed premise that one can write code that runs in the browser as well as the backend. The security posture for the code running in the browser is very different from the code running on a trusted backend. A separation of concerns allows one to have two codebases, one frontend (untrustworthy but limited access) and one backend (trustworthy but a lot of access).

While it's true that running code in isomorphic manner by definition gives you more footguns, you can mitigate it somewhat if you architect the framework with that in mind. In rust land for example, you can just not implement "Serialize" trait on your sensitive data structs and it can't leave server realm without developer jumping through some hoops.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#66

Post by crab_galaxy »

koolba wrote: post #31
tdhz77 wrote: post #23

I hate how productive with this framework I am. I try to move on and can’t. I’ll take a security hit to use it lover leptos.

What does this get you over vanilla express servicing a react front end? Is it the rest of the deploy infra? The vanilla app you can push to Heroku or any of its clones.

They’re different tools. If I were building a JS server for a backend, I’d use Express. Next gives you things like server side rendering and static site generation out of the box, and abstracts/blurs the line between server and client code through its paradigms. For better or for worse.

The deploy infrastructure is quite nice. Nextjs is surprisingly low config, even if you forego the Vercel deployment route it’s not difficult to generate a static site or docker container

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#67

Post by tshaddox »

ronbenton wrote: post #25

Oh my word: The exploit involves crafting HTTP requests containing the malicious header: GET /protected-route HTTP/1.1 Host: vulnerable-app.com x-middleware-subrequest: true So... just adding a "x-middleware-subrequest: true" header bypasses auth? Am I understanding this correctly?

“Bypasses auth” is a weird way to put it, although everyone seems to describe it in those terms. It bypasses middleware, which is bad (and embarrassing for Vercel), but middleware shouldn’t be responsible for access control. The middleware shouldn’t be doing much more than redirecting to the sign-in page if you don’t have a session.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#68

Post by FINDarkside »

ashishb wrote: post #39

Next.js is based on a fundamentally flawed premise that one can write code that runs in the browser as well as the backend. The security posture for the code running in the browser is very different from the code running on a trusted backend. A separation of concerns allows one to have two codebases, one frontend (untrustworthy but limited access) and one backend (trustworthy but a lot of access).

This vuln doesn't really have anything to do with that premise. Middleware always run on the server.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#69

Post by tshaddox »

ashishb wrote: post #39

Next.js is based on a fundamentally flawed premise that one can write code that runs in the browser as well as the backend. The security posture for the code running in the browser is very different from the code running on a trusted backend. A separation of concerns allows one to have two codebases, one frontend (untrustworthy but limited access) and one backend (trustworthy but a lot of access).

This vulnerability has nothing to do with isomorphic code, right? Next middleware only runs on the server (or on “the edge,” which is still a server even if it’s running in a browser-esque environment).
Post reply on HN