Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
c.im is one of the many independent Mastodon servers you can use to participate in the fediverse.
C.IM is a general, mainly English-speaking Mastodon instance.

Administered by:

Server stats:

2.9K
active users

c.im: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#Nextjs

27 posts26 participants0 posts today
Captain Steph<p>What are your thoughts on Vercel and Next JS? It seems like a walked garden to me...</p><p><a href="https://fosstodon.org/tags/react" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>react</span></a> <a href="https://fosstodon.org/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://fosstodon.org/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a></p>
platform.sh<p>[Tutorial 🚀] Trying to modernize your Symfony setup? This new guide shows how to decouple your frontend using Next.js—for better performance, faster deploys, and dev workflow wins.</p><p>It’s practical, detailed, and designed to help you iterate faster without breaking your architecture.</p><p>👉 <a href="https://brnw.ch/DecoupleyourSymfonyfrontendwithnextjs" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">brnw.ch/DecoupleyourSymfonyfro</span><span class="invisible">ntendwithnextjs</span></a></p><p><a href="https://mastodon.social/tags/Symfony" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Symfony</span></a> <a href="https://mastodon.social/tags/Nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Nextjs</span></a> <a href="https://mastodon.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebDev</span></a> <a href="https://mastodon.social/tags/FullStack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FullStack</span></a></p>
The New Oil<p>Critical flaw in <a href="https://mastodon.thenewoil.org/tags/Nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Nextjs</span></a> lets hackers bypass authorization</p><p><a href="https://www.bleepingcomputer.com/news/security/critical-flaw-in-nextjs-lets-hackers-bypass-authorization/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/critical-flaw-in-nextjs-lets-hackers-bypass-authorization/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a></p>
Julio J. 🀲<p>LB: the vuln itself is crazy, but even crazier is the way Vercel decided to handle the whole thing 🤯</p><p>Post by researchers: <a href="https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">zhero-web-sec.github.io/resear</span><span class="invisible">ch-and-things/nextjs-and-the-corrupt-middleware</span></a></p><p>Summary of Vercel situation: <a href="https://xcancel.com/amasad/status/1903654014962819448" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">xcancel.com/amasad/status/1903</span><span class="invisible">654014962819448</span></a></p><p>LB: <a href="https://infosec.exchange/@cR0w/114201195359591645" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.exchange/@cR0w/1142011</span><span class="invisible">95359591645</span></a></p><p><a href="https://hachyderm.io/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://hachyderm.io/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <a href="https://hachyderm.io/tags/vercel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vercel</span></a></p>
Nils Hartmann<p>Morgen ist "Fremdsprachen-Tag" bei der <a href="https://norden.social/tags/JUG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JUG</span></a> Hamburg: Ich möchte euch das <a href="https://norden.social/tags/React" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>React</span></a>-Framework <a href="https://norden.social/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> vorstellen und mit klassischen <a href="https://norden.social/tags/Java" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Java</span></a>-Architekturen vergleichen (mal sehen, ob das klappt...)</p><p>Freue mich, euch ab 19 Uhr zu sehen: <a href="https://www.meetup.com/jug-hamburg/events/306742794" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">meetup.com/jug-hamburg/events/</span><span class="invisible">306742794</span></a></p><p>👋</p><p><a href="https://norden.social/tags/JavaUserGroup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaUserGroup</span></a></p>
Caravana Blues<p>Exploring SSR Patterns: Next.js, Nuxt.js, and Alternatives <a href="https://chat-to.dev/post?id=TVRpYklqejFjdnlZQXlHR3JHU0Jkdz09" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">chat-to.dev/post?id=TVRpYklqej</span><span class="invisible">FjdnlZQXlHR3JHU0Jkdz09</span></a> <a href="https://mastodon.social/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <a href="https://mastodon.social/tags/nuxtjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nuxtjs</span></a> <a href="https://mastodon.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>javascript</span></a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a></p>
Opalsec :verified:<p>Hey folks, ready for your daily dose of cyber intel? ☕️</p><p>Tuesday's update is out and it's packed with need-to-know updates:</p><p>🚨 Critical Next.js Flaw: Authorization bypass vulnerability (CVE-2025-29927) impacting versions before 15.2.3. Upgrade ASAP or block those 'x-middleware-subrequest' headers!</p><p>🐜 Weaver Ant's Long Game: Chinese hackers spied on a telco network for four years using compromised Zyxel routers and custom web shells. Talk about persistence!</p><p>🐍 VanHelsing RaaS Emerges: A new ransomware player targeting Windows, ARM, ESXi systems. Keep an eye on this one!</p><p>☁️ Oracle Cloud Breach Claims: Did they or didn't they? Oracle denies a breach, but a threat actor is claiming otherwise. </p><p>🚂 Ukrainian Railway Hit: Cyberattack disrupts online ticket sales amidst crucial transport operations. Resilience is key.</p><p>🔄 DrayTek Router Chaos: ISPs are scrambling as DrayTek routers enter reboot loops. Potential vulnerability or buggy update at play.</p><p>🤖 AI-Enhanced Cybercrime: Europol warns that organized crime is leveling up with AI, partnering with state-aligned entities. </p><p>🛰️ Starlink Intercepted: Thai authorities seize Starlink transmitters headed for Myanmar scam centers. Criminals are finding ways around cut-offs.</p><p>🚓 Cybercrime Crackdown: 300+ suspects arrested in Africa for cyber scams. A win for international law enforcement!</p><p>🧬 23andMe's Bankruptcy Woes: Privacy advocates raise concerns about DNA data as 23andMe files for bankruptcy. What happens to all that genetic info?</p><p>🔒 Pennsylvania County Ransomware: Sensitive data stolen during a ransomware attack. Another reminder to shore up those defenses.</p><p>👁️‍🗨️ China Bans Facial Recognition: Consent is now required for facial recognition in China. But are there exceptions for government and AI training?</p><p>👉 Dive into the full details here: <a href="https://opalsec.io/daily-news-update-tuesday-march-25-2025-australia-melbourne/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.io/daily-news-update-t</span><span class="invisible">uesday-march-25-2025-australia-melbourne/</span></a></p><p>Stay vigilant, stay informed, and let's keep the digital world a little safer, one update at a time. 🛡️ </p><p><a href="https://infosec.exchange/tags/Cyber" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cyber</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> <a href="https://infosec.exchange/tags/China" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>China</span></a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/Cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybercrime</span></a> <a href="https://infosec.exchange/tags/DataBreach" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataBreach</span></a> <a href="https://infosec.exchange/tags/Privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Privacy</span></a> <a href="https://infosec.exchange/tags/Starlink" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Starlink</span></a> <a href="https://infosec.exchange/tags/Europol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Europol</span></a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://infosec.exchange/tags/WeaverAnt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WeaverAnt</span></a> <a href="https://infosec.exchange/tags/VanHelsing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>VanHelsing</span></a> <a href="https://infosec.exchange/tags/OracleCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OracleCloud</span></a> <a href="https://infosec.exchange/tags/Ukraine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ukraine</span></a> <a href="https://infosec.exchange/tags/DrayTek" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DrayTek</span></a> <a href="https://infosec.exchange/tags/23andMe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>23andMe</span></a> <a href="https://infosec.exchange/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttack</span></a> <a href="https://infosec.exchange/tags/infosecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosecurity</span></a> <a href="https://infosec.exchange/tags/Privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Privacy</span></a> <a href="https://infosec.exchange/tags/DataPrivacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataPrivacy</span></a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/InfoSecNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSecNews</span></a> <a href="https://infosec.exchange/tags/News" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>News</span></a></p>
Sam Stepanyan :verified: 🐘<p><a href="https://infosec.exchange/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a>: Critical <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerability</span></a> in NextJS (CVE-2025-29927) impacts all NextJS versions before 15.2.3, 14.2.25, 13.5.9, 12.3.5 allowing attackers to bypass authorisation checks.</p><p>Great explanation and a Proof-of-Concept demonstration by @_JohnHammond <br>👇<br><a href="https://www.youtube.com/watch?v=dL1a0KcAW3Y" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">youtube.com/watch?v=dL1a0KcAW3Y</span><span class="invisible"></span></a></p>
Chris​‌​‬ Hayes‌​​​<p>If you're self-hosting Next.js outside Vercel or Netlify and you use middleware (for ie, authentication), your project could have a critical vulnerability. <a href="https://fosstodon.org/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <br><a href="https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">zhero-web-sec.github.io/resear</span><span class="invisible">ch-and-things/nextjs-and-the-corrupt-middleware</span></a></p>
Karthikeyan A K<p>Looking for freelance <a href="https://mstdn.social/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> devs. Potential to earn upto ₹20K a week.</p><p><a href="https://mstdn.social/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://mstdn.social/tags/Job" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Job</span></a> <a href="https://mstdn.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebDev</span></a> <a href="https://mstdn.social/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebDevelopment</span></a> <a href="https://mstdn.social/tags/India" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>India</span></a></p>
Vale<p>Reject modernity (Next.js); embrace tradition (PHP).</p><p><a class="hashtag" href="https://fedi.vale.rocks/tag/nextjs" rel="nofollow noopener noreferrer" target="_blank">#NextJS</a> <a class="hashtag" href="https://fedi.vale.rocks/tag/php" rel="nofollow noopener noreferrer" target="_blank">#PHP</a> <a class="hashtag" href="https://fedi.vale.rocks/tag/webdev" rel="nofollow noopener noreferrer" target="_blank">#WebDev</a></p>
𝕂𝚞𝚋𝚒𝚔ℙ𝚒𝚡𝚎𝚕<p>»Critical Next.js Middleware Vulnerability Allows Attackers to Bypass Authorization:<br>A severe vulnerability has been identified in Next.js, a popular React framework used for building web applications, under the designation CVE-2025-29927.«</p><p>Well, I have to give it up and look at it.</p><p>🧑‍💻 <a href="https://gbhackers.com/critical-next-js-middleware-vulnerability/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gbhackers.com/critical-next-js</span><span class="invisible">-middleware-vulnerability/</span></a></p><p><a href="https://chaos.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>javascript</span></a> <a href="https://chaos.social/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <a href="https://chaos.social/tags/webdev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webdev</span></a> <a href="https://chaos.social/tags/react" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>react</span></a> <a href="https://chaos.social/tags/sec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sec</span></a> <a href="https://chaos.social/tags/framework" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>framework</span></a> <a href="https://chaos.social/tags/middleware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>middleware</span></a> <a href="https://chaos.social/tags/server" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>server</span></a> <a href="https://chaos.social/tags/itsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>itsec</span></a></p>
Frontend Dogma<p>Next.js vs. TanStack, by @gill_kyle@x.com:</p><p><a href="https://www.kylegill.com/essays/next-vs-tanstack/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">kylegill.com/essays/next-vs-ta</span><span class="invisible">nstack/</span></a></p><p><a href="https://mas.to/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <a href="https://mas.to/tags/comparisons" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>comparisons</span></a></p>
Socket<p>🚨 Next.js has patched a critical vulnerability that lets attackers bypass auth middleware in self-hosted apps. Immediate action is necessary: patch now. </p><p><a href="https://socket.dev/blog/next-js-patches-critical-middleware-vulnerability" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">socket.dev/blog/next-js-patche</span><span class="invisible">s-critical-middleware-vulnerability</span></a> <a href="https://fosstodon.org/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nextjs</span></a> <a href="https://fosstodon.org/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>javascript</span></a></p>
Konstantin :C_H:<p>With <a href="https://infosec.exchange/tags/CVE_2025_29927" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE_2025_29927</span></a>, Next.js has now suffered its second major vulnerability in just three months, following <a href="https://infosec.exchange/tags/CVE_2024_51479" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE_2024_51479</span></a>.</p><p>I originally built CVE Crowd with <a href="https://infosec.exchange/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a>.</p><p>However, as the application became more complex (especially with authentication), I decided to switch to a framework I was more familiar with.</p><p>Honestly, I’m feeling a bit relieved about that right now...</p><p><a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/BugBounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BugBounty</span></a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Hacking</span></a> <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE</span></a> <a href="https://infosec.exchange/tags/CVECrowd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVECrowd</span></a></p>
Suzanne Aldrich (she/her)<p>Critical Next.js Middleware Vulnerability (CVE-2025-29927)</p><p>A major auth bypass vulnerability in Next.js middleware (prior to v14.2.25 / v15.2.3) allows attackers to inject the x-middleware-subrequest header and bypass authorization entirely. Exploitable via simple HTTP requests—no user interaction, no special permissions.</p><p>Patch. Now. Or block the header manually.</p><p>GitHub scored this 9.1 CRITICAL, but the real issue? This flaw exposes a systemic weakness in middleware validation, and some vendors weren’t exactly upfront about the risks.</p><p>Details + POC: <a href="https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-auth-bypass" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">zeropath.com/blog/nextjs-middl</span><span class="invisible">eware-cve-2025-29927-auth-bypass</span></a><br>NVD: <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29927" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nvd.nist.gov/vuln/detail/CVE-2</span><span class="invisible">025-29927</span></a></p><p>Security theater is easy. Secure defaults and transparency are harder—but essential.</p><p><a href="https://hachyderm.io/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://hachyderm.io/tags/AppSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AppSec</span></a> <a href="https://hachyderm.io/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> <a href="https://hachyderm.io/tags/CVE202529927" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE202529927</span></a> <a href="https://hachyderm.io/tags/middleware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>middleware</span></a> <a href="https://hachyderm.io/tags/securityfail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityfail</span></a></p>
:mastodon: decio<p>⚠️ Une faille critique dans <strong>Next.js</strong> permet de contourner les vérifications d'autorisation effectuées dans le middleware.<br><br>👉 Framework React trés populaire pour le rendu web côté serveur.</p><p>🔍 <strong>Détails techniques</strong><br><br>En injectant l'en-tête <code>x-middleware-subrequest</code>, un attaquant peut <strong>bypasser les contrôles d'accès</strong> et accéder à des ressources normalement protégées. </p><p>💥 Exploit documenté ici <br>⬇️ <br>"Next.js and the corrupt middleware: the authorizing artifact"<br>👇 <br><a href="https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">zhero-web-sec.github.io/resear</span><span class="invisible">ch-and-things/nextjs-and-the-corrupt-middleware</span></a></p><p>🛡️ <strong>Versions vulnérables</strong> </p><ul><li>15.x &lt; 15.2.3<br></li><li>14.x &lt; 14.2.25<br></li><li>11.1.4 → 13.5.6</li></ul><p>🔧 <strong>Solutions</strong><br><br>✔️ Mettez à jour vers <strong>15.2.3</strong> ou <strong>14.2.25</strong><br><br>👇 <br><a href="https://nextjs.org/blog/cve-2025-29927" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">nextjs.org/blog/cve-2025-29927</span><span class="invisible"></span></a><br>⬇️ <br><a href="https://github.com/advisories/GHSA-f82v-jwr5-mffw" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/advisories/GHSA-f82</span><span class="invisible">v-jwr5-mffw</span></a></p><p>✔️ En attendant : <strong>bloquez les requêtes</strong> contenant <code>x-middleware-subrequest</code> côté serveur / WAF</p><p>🛰️ Et effectivement selon le moteur de recherche de surface d’attaque ONYPHE,<br><br>il y en a un paquet… y compris en Suisse 🇨🇭 </p><p><a href="https://infosec.exchange/tags/CyberVeille" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberVeille</span></a> <a href="https://infosec.exchange/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> <a href="https://infosec.exchange/tags/CVE_2025_29927" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE_2025_29927</span></a> <a href="https://infosec.exchange/tags/websec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>websec</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/onyphe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>onyphe</span></a> <a href="https://infosec.exchange/tags/ASD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ASD</span></a></p>
LavX News<p>Critical CVE-2025-29927 Vulnerability Exposes Next.js Middleware to Authorization Bypass</p><p>A newly disclosed vulnerability in Next.js, CVE-2025-29927, allows attackers to bypass middleware protections, raising serious security concerns for developers. The Next.js team has swiftly released p...</p><p><a href="https://news.lavx.hu/article/critical-cve-2025-29927-vulnerability-exposes-next-js-middleware-to-authorization-bypass" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">news.lavx.hu/article/critical-</span><span class="invisible">cve-2025-29927-vulnerability-exposes-next-js-middleware-to-authorization-bypass</span></a></p><p><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>news</span></a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tech</span></a> <a href="https://mastodon.cloud/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> <a href="https://mastodon.cloud/tags/CVE2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2025</span></a> <a href="https://mastodon.cloud/tags/MiddlewareSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MiddlewareSecurity</span></a></p>
LavX News<p>Unveiling a Critical Vulnerability in Next.js Middleware: A Deep Dive</p><p>A recent security discovery has exposed a critical vulnerability in Next.js middleware, affecting all versions from 11.1.4 onwards. This flaw allows attackers to bypass authentication and authorizatio...</p><p><a href="https://news.lavx.hu/article/unveiling-a-critical-vulnerability-in-next-js-middleware-a-deep-dive" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">news.lavx.hu/article/unveiling</span><span class="invisible">-a-critical-vulnerability-in-next-js-middleware-a-deep-dive</span></a></p><p><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>news</span></a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tech</span></a> <a href="https://mastodon.cloud/tags/NextJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NextJS</span></a> <a href="https://mastodon.cloud/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebSecurity</span></a> <a href="https://mastodon.cloud/tags/CVE2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE2025</span></a></p>
Hacker News<p>CVE-2025-29927 – Next.js</p><p><a href="https://nextjs.org/blog/cve-2025-29927" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">nextjs.org/blog/cve-2025-29927</span><span class="invisible"></span></a></p><p><a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HackerNews</span></a> <a href="https://mastodon.social/tags/CVE202529927" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVE202529927</span></a> <a href="https://mastodon.social/tags/Nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Nextjs</span></a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Security</span></a> <a href="https://mastodon.social/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Vulnerability</span></a> <a href="https://mastodon.social/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebDevelopment</span></a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a></p>
ExploreLive feeds
About