CVE-2025-29927 – Next.js

butterlettuce · 2025-03-22T22:47:09 1742683629

Vercel’s reputation is so cooked. Jeez.

czk · 2025-03-22T22:47:30 1742683650

it only took 16 days to triage a global next.js auth bypass

makepanic · 2025-03-22T21:19:07 1742678347

> Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops. The security report showed it was possible to skip running Middleware, which could allow requests to skip critical checks—such as authorization cookie validation—before reaching routes.

urbandw311er · 2025-03-22T22:42:51 1742683371

We opted for self-hosted next.js as the architecture for the web app we are building because we believed a lot of the hype.

The more comments I read about it in HN, the less comfortable I feel about this decision.

mrits · 2025-03-22T22:45:10 1742683510

I spent about a week coding in it trying to to figure out what the hype was about. I decided to go with django/htmx. A year later I have absolutely no regrets.

Lucasoato · 2025-03-22T22:48:04 1742683684

Is NextJS considered safe? Would you build something for the government or a big Corp with it?

nextts · 2025-03-22T22:51:26 1742683886

No. I wasn't concerned about security but just churn. They keep changing things. They also don't fix stuff people care about alot.

I'd just use Koa and keep it simple.

ldjkfkdsjnv · 2025-03-22T22:38:21 1742683101

This is one of the worst security vulnerabilities I have seen in a while. It's so blatant, so easy to exploit. So many nextjs applications written by beginners that are completely exposed.

nextts · 2025-03-22T22:49:43 1742683783

Middleware skipping could expose all kinds of problems. A lot is done in middleware that the rest of the code can lay back and assume is dealt with.

mrits · 2025-03-22T22:46:44 1742683604

It's going to take awhile for the LLMs to catch up so we can un-vibe our way out of this

colonelspace · 2025-03-22T22:57:31 1742684251

Unvibe AI (YC S25) is hiring.

teaearlgraycold · 2025-03-22T22:45:21 1742683521

Written by anybody

nextts · 2025-03-22T22:50:19 1742683819

Vibe coding framework of choice

(评论) (comments)

(评论)
(comments)