[flagged]
Next.js version 15.2.3 has been released to address a security vulnerability
71–80 of 220 posts
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#72[flagged]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#73[flagged]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#74[dead]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#75[dead]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#76[dead]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#77[dead]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#78[dead]
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#79Earlier quoted context omitted.
I think you have to ask what it’s compared to. Certainly this is no worse than things we’ve seen in the PHP or Java space and people still use those. However, there is one argument you could make regarding the massive amount of complexity which Next takes on trying to blur client and server execution. That’s prone to creating confusion around validation and control flow, which is a notorious source of security vulner…
> no worse than things we’ve seen in Java space My memory fails me - I can’t recall a vulnerability in the JVM ecosystem that allows an attacker to circumvent auth entirely with such trivial ease. Can you name an example?
What about Log4J? Just to answer your question, we’re talking about two completely different ecosystems!
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#80This is a wild vuln in how trivial it is to execute. But maybe even wilder is the timeframe to event _start_ triaging the bug after it was reported. How? Was it incorrectly named? Was the severity not correctly stated? Someone help me understand how this sits for 2+ weeks. 2025-02-27T06:03Z: Disclosure to Next.js team via GitHub private vulnerability reporting 2025-03-14T17:13Z: Next.js team started triaging the repo…
Yeah, "obvious" critical vulnerability that is easy to use against any Nextjs app, spend 2 weeks making a fix and then announce on Friday evening that all Nextjs apps are free game. Lovely. Luckily doens't affect any of the sites I'm responsible for, since I hated middleware and most of the Nextjs "magic" features already.
"Luckily doesn't affect any of the sites I'm responsible for, since I hated middleware and most of the Nextjs "magic" features already."
This is probably the most important comment. You don't have to use Next.js, and if you do have to, you don't have to use everything they have in it.