[HN Gopher] CVE-2025-29927 - Next.js
       ___________________________________________________________________
        
       CVE-2025-29927 - Next.js
        
       Author : makepanic
       Score  : 33 points
       Date   : 2025-03-22 21:19 UTC (1 hours ago)
        
 (HTM) web link (nextjs.org)
 (TXT) w3m dump (nextjs.org)
        
       | makepanic wrote:
       | > Next.js uses an internal header x-middleware-subrequest to
       | prevent recursive requests from triggering infinite loops. The
       | security report showed it was possible to skip running
       | Middleware, which could allow requests to skip critical checks--
       | such as authorization cookie validation--before reaching routes.
        
       | ldjkfkdsjnv wrote:
       | This is one of the worst security vulnerabilities I have seen in
       | a while. It's so blatant, so easy to exploit. So many nextjs
       | applications written by beginners that are completely exposed.
        
         | teaearlgraycold wrote:
         | Written by anybody
        
           | nextts wrote:
           | Vibe coding framework of choice
        
         | mrits wrote:
         | It's going to take awhile for the LLMs to catch up so we can
         | un-vibe our way out of this
        
           | colonelspace wrote:
           | _Unvibe AI (YC S25) is hiring._
        
         | nextts wrote:
         | Middleware skipping could expose all kinds of problems. A lot
         | is done in middleware that the rest of the code can lay back
         | and assume is dealt with.
        
       | urbandw311er wrote:
       | We opted for self-hosted next.js as the architecture for the web
       | app we are building because we believed a lot of the hype.
       | 
       | The more comments I read about it in HN, the less comfortable I
       | feel about this decision.
        
         | mrits wrote:
         | I spent about a week coding in it trying to to figure out what
         | the hype was about. I decided to go with django/htmx. A year
         | later I have absolutely no regrets.
        
       | butterlettuce wrote:
       | Vercel's reputation is so cooked. Jeez.
        
       | czk wrote:
       | it only took 16 days to triage a global next.js auth bypass
        
       | Lucasoato wrote:
       | Is NextJS considered safe? Would you build something for the
       | government or a big Corp with it?
        
         | nextts wrote:
         | No. I wasn't concerned about security but just churn. They keep
         | changing things. They also don't fix stuff people care about
         | alot.
         | 
         | I'd just use Koa and keep it simple.
        
       ___________________________________________________________________
       (page generated 2025-03-22 23:00 UTC)