91–100 of 220 posts
Is NextJS considered safe? Would you build something for the government or a big Corp with it?
Yes, as much hate as it tends to get on here it's really fine. This vulnerability is unfortunate but every library/framework will have security issues over its lifespan.
This is one of the worst security vulnerabilities I have seen in a while. It's so blatant, so easy to exploit. So many nextjs applications written by beginners that are completely exposed.
It's going to take awhile for the LLMs to catch up so we can un-vibe our way out of this
Interviewer:
How do you handle vibe changes in vibe coding?
Candidate:
I can handle any type of vibe change.
Interviewer:
This is exactly what we are looking for.
Looking at next I have to think that something went horribly wrong with front end development. It adds so much complexity for things that provide such minimal value to most apps. React added a lot of complexity to the front end, but, for an app with a lot of front end state, brought a ton of value. Next brings us file based routing, which seems cool, until you get into any sort of mildly complex use case, and — if yo…
> React added a lot of complexity to the front end, I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. SSR has been misused widely for years and we’re now starting to see the effects of that. But there ARE great use cases for SSR. And frontend dev is the easiest it’s ever been. Run Vite Create and you have a…
Looking at next I have to think that something went horribly wrong with front end development. It adds so much complexity for things that provide such minimal value to most apps. React added a lot of complexity to the front end, but, for an app with a lot of front end state, brought a ton of value. Next brings us file based routing, which seems cool, until you get into any sort of mildly complex use case, and — if yo…
> React added a lot of complexity to the front end, I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. SSR has been misused widely for years and we’re now starting to see the effects of that. But there ARE great use cases for SSR. And frontend dev is the easiest it’s ever been. Run Vite Create and you have a…
You're using a different frame of reference. Those people you're referring to, including gp, probably mean that frameworks add complexity to the frontend. That would include all the ones you listed.
> Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops. The security report showed it was possible to skip running Middleware, which could allow requests to skip critical checks—such as authorization cookie validation—before reaching routes.
Not a web dev, so struggling a bit to understand this. Are they saying they had a special flag that allowed requests to bypass auth, intended to be used by calls generated internally? And someone figured out you could just send that on the first request and skip auth entirely?
next.js has a history of similar vulnerabilities. I was made aware recently of a vulnerability that was fixed by this patch: https://github.com/vercel/next.js/pull/73482/files In this vulnerability, adding a 'x-middleware-rewrite: https://www.example.com ' header would cause the server to respond with the contents of example.com. i.e. the worlds dumbest SSRF. Note that there is no CVE for this vulnerability, nor is t…
Oh my word: The exploit involves crafting HTTP requests containing the malicious header: GET /protected-route HTTP/1.1 Host: vulnerable-app.com x-middleware-subrequest: true So... just adding a "x-middleware-subrequest: true" header bypasses auth? Am I understanding this correctly?
This is a wild vuln in how trivial it is to execute. But maybe even wilder is the timeframe to event _start_ triaging the bug after it was reported. How? Was it incorrectly named? Was the severity not correctly stated? Someone help me understand how this sits for 2+ weeks. 2025-02-27T06:03Z: Disclosure to Next.js team via GitHub private vulnerability reporting 2025-03-14T17:13Z: Next.js team started triaging the repo…
Seems indicative of the companies priorities especially as of late. This has always been an issue with Vercel. I highly recommend people stay way from their stuff.
Earlier quoted context omitted.
expect you know, when you can bypass auth by adding an http header :)
Not that this isn't a serious attack vector (a possible one), but most implementations are not simply using middleware as a standalone check for authorization then blindly serving paths/content up. That'd be pretty bad architecture in any stack.