Next.js – Server-side request forgery in applications using WebSocket upgrades
3 points · Open discussionvercel
next.js
JavaScript2016–2026
vercel / next.js
next.js
The React Framework
165Distinct people
198Mentions
3Explicit recommenders
143.5KGitHub stars
What to know before exploring
What it is
The React Framework
GitHub
Where it is used
What people are saying
> You don't think you're maybe contorting yourself to make some of these arguments work? First of all, I still prefer TypeScript to Python when it comes to language features.…
spion used a recommendation phrase. 3 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- react/create-react-app · linked in 4 of the same discussions
- gatsbyjs/gatsby · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year198 dated mentions
Observed mentions: 2016-10-25 16:05:56 UTC to 2026-05-15 16:42:15 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 3 | 2 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 19 | 2 | 17 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 14 | 1 | 13 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 18 | 2 | 16 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 29 | 3 | 26 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 19 | 3 | 16 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 29 | 3 | 26 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 13 | 1 | 12 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 38 | 8 | 30 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 8 | 3 | 5 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Next.js
Getting Started
Used by some of the world's largest companies, Next.js enables you to create full-stack web applications by extending the latest React features, and integrating powerful Rust-based JavaScript tooling for the fastest builds.
Visit our Learn Next.js course to get started with Next.js.
Visit the Next.js Showcase to see more sites built with Next.js.
Documentation
Visit https://nextjs.org/docs to view the full documentation.
Community
The Next.js community can be found on GitHub Discussions where you can ask questions, voice ideas, and share your projects with other people.
To chat with other community members, you can join the Next.js Discord server.
Do note that our Code of Conduct applies to all Next.js community channels. Users are highly encouraged to read and adhere to it to avoid repercussions.
Contributing
Contributions to Next.js are welcome and highly appreciated. However, before you jump right into it, we would like you to review our Contribution Guidelines to make sure you have a smooth experience contributing to Next.js.
Good First Issues:
We have a list of good first issues that contain bugs that have a relatively limited scope. This is a great place for newcomers and beginners alike to get started, gain experience, and get familiar with our contribution process.
Security
If you believe you have found a security vulnerability in Next.js, we encourage you to responsibly disclose this and NOT open a public issue.
To participate in our Open Source Software Bug Bounty program, please visit https://hackerone.com/vercel.
Read the full README on GitHubWhat Hacker News says
198 sourcesNew security vulnerabilities disclosed in Next.js (patches released)
3 points · Open discussionSix New High Severity CVEs for Next.js and 1 for React
4 points · Open discussionLooks like this a known issue with embedding JSON.
I found a dozen of related issues in the context of Next.js:
* https://github.com/vercel/next.js/issues/40143
* https://github.com/vercel/next.js/discussions/39377
* https://github.com/vercel/next.js/discussions/66896
* https://stackoverflow.com/questions/75672103/how-can-i-block...
Crazy that this isn't addressed as it affects every website.
In Ask HN: Google started to index non-hyperlinks. What to do about it?This is probably the most interesting AI experiment I've seen yet. Looking through the codebase has me wondering where all the code is. I don't know if anyone has had the displeasure of going through the next.js codebase, but I estimate it's at least two orders of magnitude more code than this reimplementation. Which makes me wonder, does it actually handle the edge cases or does it just pass the tests.
Like compare the two form implementations for example. Vinext is a completely different implementation compared to what the Next.js version does. Is their behaviour actually the same? The rewrite looks incredibly naive.
https://github.com/vercel/next.js/blob/b8cbaad24ca66ec673a7b...
https://github.com/cloudflare/vinext/blob/main/packages/vine...
Either way, pretty impressive.
In How we rebuilt Next.js with AI in one weekHey HN, I built QuickGitHub.
The idea is simple: take any GitHub URL, add “quick” before github.com, and get AI-generated system design documentation in under 60 seconds.
github.com/vercel/next.js → quickgithub.com/vercel/next.js
The generated docs include a system overview, architecture breakdown, key modules, tech stack, entry points, and dependencies.
There’s also a Q&A chat to ask follow-up questions about the repo.
Why I built this:
I think we’re heading toward a world where most code is written by AI agents, and the bottleneck shifts from writing code to understanding what was written. Traditional docs assume a human author. I wanted something that could explain any codebase instantly, regardless of who (or what) wrote it.
Some details:
* Each repo is indexed once and cached permanently
* Login required via GitHub OAuth (one free re
Read the rest
po per account)
* All generated docs are public by default
* It’s open source: github.com/stym06/quickgithub
Would love feedback on the quality of the generated docs.
Try it on a repo you know well and tell me where it gets things wrong. that’s the most useful feedback I can get.
This is a good write up on the workings. However, in actual use, Turbopack has severe limitations when compared to Webpack. I’ve been working on https://jsonquery.app and rely on the jq WASM dependency for the queries. But, Turbopack cannot handle importing a WASM binary or the glue code for it directly. The workaround is to have a script copy the binary to the public directory. But that's not all. jq-wasm has a dependency on the ‘fs’ module, even though no fs functions are used. But trying to resolve this in Turbopack is not possible and 2 days of fighting this was a waste of time.
Webpack solved this problem with a few lines in the next.config.ts
For now, I’m back to using Webpack with NextJS 16 with the —Webpack flag. Hope they allow this for future versions.
There are plenty of complaints on the NextJS subreddit, and here is a open th
Read the rest
read on complaints with Turbopack https://github.com/vercel/next.js/discussions/77721
Looks the alternative is Rspack?
For https://cartes.app, I'm planning to code an extremely light version of the map tiles. Based on initial network speed, decide to load this style first, that just lets the user see the streets and and important places. Then load the rest.
This initial map style would be the equivalent of a "text-only" website.
Blocked by Vercel's turbopack bundle analyzer's bugs though, because before optimizing the tiles, I need to optimize the JS that loads the tiles.
I haven't figured a way to load a Maplibre map server side, so the JS must be ready before the map starts to get loaded.
https://github.com/vercel/next.js/discussions/86731
In During Helene, I just wanted a plain text websiteNext.js makes many tiny serverless requests for all visible links
2 points · Open discussion> This isn't a Javascript problem, this is a React problem.
It happened with Next.js as well https://github.com/vercel/next.js/discussions/11106
> Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.
Yes.
And since Python does not natively run in the browser, that mistake never happens.
With JavaScript, the desire to have "backend and frontend in a single codebase" requires active resistance.
In Denial of service and source code exposure in React Server ComponentsThis happens in Next.js as well https://github.com/vercel/next.js/discussions/11106
In Denial of service and source code exposure in React Server ComponentsHere's a patch diff:
https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5
It looks like the fix is checking hasOwnProperty, so it's almost certainly an issue with prototype chain pollution.
In Critical RCE Vulnerabilities in React and Next.jsRCE Vulnerability in React and Next.js
628 points · Open discussion> much better than the mess of Webpack/Rollup/Brunch/Grunt/Gulp/Bower/Browserify/Parcel/Snowpack/Turbopack/Babel/etc/etc.
What? That mess is still ongoing. Next.js for example (probably the most popular "out of the box" solution) technically uses SWC, but not quite, because it doesn't support `styled-components` so you need to use Babel for that. But wait, you might also need to use tailwind, and for that you'll need `postcss` which might also work with Babel with `babel-plugin-import-postcss` but not necessarily, could also just use it as a Next plugin, but that doesn't always[1] seem to work.
I don't think this mess will ever end unless we throw React/Vue, and all "reactive" frameworks in the dustbin and we'll get enough folks on board to re-invent the web starting from scratch. But no one really wants to do that (yet?), so even things
Read the rest
like Bun or Deno will try to be as compatible as possible making continuous concessions that will lead to the ongoing spaghettification of toolchains.
[1] https://github.com/vercel/next.js/discussions/65625
Try to scale Next.js globally.
Try to keep up to date with new versions, changes in paradigms and the way the output is rendered.
It's designed to be deployed on Vercel. Production-ready hosting part of the Framework is not Open Source nor well documented.
https://github.com/vercel/next.js/discussions/59167
https://www.netlify.com/blog/how-we-run-nextjs/
In The React FoundationShowing the 15 most recent of 198 sources. Enable JavaScript to search and browse every indexed mention.