architecture

Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows

The data says React core has almost no CVEs while Next.js CVEs are numerous and rising. What matters is where they are: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization bypass leading the CWEs. This site's conclusion: Next.js should not be treated as only a front-end framework. It runs as a server, so defend it like one: authorize again at the data, allow-list outbound fetches, and put Server Action endpoints behind auth.