Next.js version 15.2.3 has been released to address a security vulnerability
1–10 of 220 posts
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#2> Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops. The security report showed it was possible to skip running Middleware, which could allow requests to skip critical checks—such as authorization cookie validation—before reaching routes.
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#3This is one of the worst security vulnerabilities I have seen in a while. It's so blatant, so easy to exploit. So many nextjs applications written by beginners that are completely exposed.
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#4We opted for self-hosted next.js as the architecture for the web app we are building because we believed a lot of the hype.
The more comments I read about it in HN, the less comfortable I feel about this decision.
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#5We opted for self-hosted next.js as the architecture for the web app we are building because we believed a lot of the hype. The more comments I read about it in HN, the less comfortable I feel about this decision.
I spent about a week coding in it trying to to figure out what the hype was about. I decided to go with django/htmx. A year later I have absolutely no regrets.
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#6This is one of the worst security vulnerabilities I have seen in a while. It's so blatant, so easy to exploit. So many nextjs applications written by beginners that are completely exposed.
Written by anybody
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#7This is one of the worst security vulnerabilities I have seen in a while. It's so blatant, so easy to exploit. So many nextjs applications written by beginners that are completely exposed.
It's going to take awhile for the LLMs to catch up so we can un-vibe our way out of this
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#8Vercel’s reputation is so cooked. Jeez.
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#9it only took 16 days to triage a global next.js auth bypass
Re: Next.js version 15.2.3 has been released to address a security vulnerability
#10Is NextJS considered safe? Would you build something for the government or a big Corp with it?