Next.js
3 articles with this tag
Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows
The data says React core is almost untouched while Next.js CVEs are numerous and rising — but the substance is what matters: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization bypass leading the CWEs. This site's conclusion is that treating Next.js as a front-end framework is the actual mistake. It is a server, so defend it like one: authorize again at the data, allow-list outbound fetches, and put Server Action endpoints behind auth.
Next.js security — a production hardening reference
Next.js's defaults are fairly safe, but incidents happen at the server/client boundary. This is a working reference: (1) a priority-ordered hardening checklist (P0–P2), (2) per-area guidance — the boundary and env vars (NEXT_PUBLIC_), dependency CVEs (including core RCE), Server Actions / Route Handlers authorization + input validation, SSRF on server-side fetches, security headers/CSP, auth/session/cookies, rate limiting, and (3) a self-verification checklist. Defensive only — no attack steps.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four pillars: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: indie devs lose not on knowledge but on operational continuity — win with a system that doesn't miss, not with speed.