Why Next.js Keeps Getting CVEs (And Why That's Actually Fine)
Hey,
I'm a security researcher and web developer (React side of things). Writing this because after the latest Next.js security advisory I've seen a ton of hate piled on the framework. People saying it's more vulnerable than the alternatives, that they're sick of it, the whole thing.
Before you jump on that train, you need to understand how bug bounty actually works.
There are highly skilled security researchers out there, and now with AI in the mix we're even more effective. What drives most of us (not saying I am one of the high skilled) is pretty simple:
- Money from bug bounties
- Recognition
So why do vulnerabilities keep popping up in Next.js and not in alternatives like TanStack Start? Simple. A few months ago Vercel launched a bug bounty program for their open source projects, and they pay solid money for vulns in stuff like Next.js.
Also, Next.js is the king of web frameworks. How many people outside the dev bubble have even heard of TanStack? Or Vinext?
That's exactly why security researchers are gunning for CVEs in Next.js. It's the most used framework, and you actually get paid for it. So you get both money and recognition.
So most of security researchers will hunt on Next.js and not in it's alternatives.
The result is that vulnerabilities surface frequently, and that's not a bad thing. Those of us who do bug bounty for a living see new vulnerabilities pop up every single day in Fortune 500 companies. The difference is most of them never get publicly disclosed, they just get patched and life moves on. It's part of the normal software lifecycle.
Using a framework with no security advisories isn't necessarily a good thing. It might just mean there aren't enough skilled people auditing it.
No software is 100% secure, that's impossible. The vulns are there. If they're not surfacing it means no one good has found them yet, but a malicious actor very well might have, and could be actively exploiting them right now.
It is actually a good thing that new vulns get patched, software gets more secure and reliable the more vulns are fixed, and also the dev team will get more understanding of security principles while aplying patches.