Next.Js Security Scan

Next.js Security Scan Skill

This skill enables comprehensive security scanning of Next.js and TypeScript/JavaScript projects based on OWASP guidelines and industry best practices.

When to Use This Skill

• Security audits of Next.js applications
• Code review for security vulnerabilities
• Pre-deployment security checks
• Dependency vulnerability assessment
• Detecting hardcoded secrets and credentials

Scan Types

1. Quick Scan

Fast scan focusing on critical vulnerabilities:

• Hardcoded secrets and API keys
• Dangerous function usage (dangerouslySetInnerHTML, eval)
• Missing authentication in Server Actions
• Known vulnerable dependencies

2. Full Scan

Comprehensive security assessment covering:

• All OWASP Top 10:2025 categories
• XSS vulnerability patterns
• Injection vulnerabilities (SQL, NoSQL, Command)
• Authentication and authorization flaws
• Security misconfigurations
• Cryptographic failures
• Next.js-specific vulnerabilities
• Dependency audit (CVE check)
• Environment variable exposure

3. Targeted Scan

Focus on specific vulnerability categories:

• --xss - Cross-site scripting patterns
• --injection - SQL/NoSQL/Command injection
• --auth - Authentication/authorization issues
• --secrets - Hardcoded credentials
• --deps - Dependency vulnerabilities
• --nextjs - Next.js specific issues

Scan Procedure

Step 1: Project Discovery

1. Identify project type (Next.js App Router, Pages Router, or plain React) 2. Locate configuration files (next.config.js, package.json, .env*) 3. Map the codebase structure

Step 2: Dependency Audit

Run the dependency audit script:

./scripts/dependency-audit.sh

Or manually:

npm audit --json
# or
yarn audit --json

Step 3: Secret Scanning

Scan for hardcoded secrets:

python scripts/secret-scanner.py /path/to/project

Important: Environment File Handling

• By default, real .env files are SKIPPED (.env, .env.local, .env.production, etc.)
• These files contain actual secrets and should not be in version control
• Only .env.example and .env.template files are analyzed for documentation quality
• Use --include-env-files flag only if explicitly requested by user

The scanner will: 1. Scan source code for hardcoded secrets 2. Analyze .env.example templates to check:

• Which sensitive variables are documented
• Whether variables have descriptions (comments)
• If placeholder values look like real secrets
• Suggestions for missing common variables

Step 4: Pattern Analysis

For each file in the codebase, check against patterns in:

• references/xss-patterns.md - XSS vulnerabilities
• references/injection-patterns.md - Injection flaws
• references/auth-vulnerabilities.md - Auth issues
• references/nextjs-specific.md - Next.js vulnerabilities

Step 5: Report Generation

Generate a security report using:

• assets/report-template.md - Report structure

Severity Classification

Key Files to Scan

Always Check

• **/*.ts, **/*.tsx, **/*.js, **/*.jsx - Source code
• next.config.js, next.config.mjs - Next.js configuration
• package.json, package-lock.json - Dependencies
• middleware.ts, middleware.js - Middleware security

Environment Files

• .env.example, .env.template - SCAN for template analysis
• .env, .env.local, .env.production - SKIP by default (contain real secrets)

Note: Real .env files should never be committed to version control. The scanner analyzes .env.example templates to ensure proper documentation of required variables.

High Priority Locations

• app/api/**/* - API routes (App Router)
• pages/api/**/* - API routes (Pages Router)
• **/actions.ts, **/*-actions.ts - Server Actions
• lib/auth*, utils/auth* - Authentication code
• **/middleware.* - Middleware files

Output Format

Findings should be reported as:

[SEVERITY] Category: Description
  File: path/to/file.ts:lineNumber
  Code: <relevant code snippet>
  Risk: <explanation of the security risk>
  Fix: <recommended remediation>

Integration with CI/CD

This skill can generate output compatible with:

• GitHub Security Advisories
• SARIF format for GitHub Code Scanning
• JSON for custom integrations

References

Load additional context as needed:

• references/owasp-top-10.md - OWASP Top 10:2025 quick reference
• references/xss-patterns.md - XSS detection patterns
• references/injection-patterns.md - Injection vulnerability patterns
• references/auth-vulnerabilities.md - Authentication security patterns
• references/nextjs-specific.md - Next.js specific vulnerabilities and CVEs

Security Scan Report

Project: {{PROJECT_NAME}} Scan Date: {{SCAN_DATE}} Scan Type: {{SCAN_TYPE}}

---

Executive Summary

Overall Risk Level: {{RISK_LEVEL}}

---

Scan Coverage

Files Scanned

• Total files: {{TOTAL_FILES}}
• Source files (.ts/.tsx/.js/.jsx): {{SOURCE_FILES}}
• Configuration files: {{CONFIG_FILES}}

Checks Performed

• [x] Dependency audit (CVE check)
• [x] Secret/credential scanning
• [x] XSS vulnerability patterns
• [x] Injection vulnerability patterns
• [x] Authentication/authorization patterns
• [x] Next.js specific vulnerabilities
• [x] Security header configuration
• [x] Environment variable exposure

---

Critical Findings

{{#CRITICAL_FINDINGS}}

{{INDEX}}. {{TITLE}}

Severity: CRITICAL Category: {{CATEGORY}} File: {{FILE}}:{{LINE}}

Vulnerable Code: ```{{LANGUAGE}} {{CODE}}

**Risk**: {{DESCRIPTION}}

**Recommendation**: {{RECOMMENDATION}}

---
{{/CRITICAL_FINDINGS}}

## High Severity Findings

{{#HIGH_FINDINGS}}
### {{INDEX}}. {{TITLE}}

**Severity**: HIGH
**Category**: {{CATEGORY}}
**File**: `{{FILE}}:{{LINE}}`

**Vulnerable Code**:

{{CODE}}

**Risk**: {{DESCRIPTION}}

**Recommendation**: {{RECOMMENDATION}}

---
{{/HIGH_FINDINGS}}

## Medium Severity Findings

{{#MEDIUM_FINDINGS}}
### {{INDEX}}. {{TITLE}}

**Severity**: MEDIUM
**Category**: {{CATEGORY}}
**File**: `{{FILE}}:{{LINE}}`

**Description**: {{DESCRIPTION}}

**Recommendation**: {{RECOMMENDATION}}

---
{{/MEDIUM_FINDINGS}}

## Low Severity & Informational Findings

{{#LOW_FINDINGS}}
- **{{TITLE}}** (`{{FILE}}:{{LINE}}`): {{DESCRIPTION}}
{{/LOW_FINDINGS}}

---

## Dependency Audit Results

### Vulnerable Dependencies

| Package | Severity | CVE | Installed | Patched |
|---------|----------|-----|-----------|---------|
{{#VULNERABLE_DEPS}}
| {{PACKAGE}} | {{SEVERITY}} | {{CVE}} | {{INSTALLED}} | {{PATCHED}} |
{{/VULNERABLE_DEPS}}

### Outdated Dependencies (Security Relevant)

| Package | Current | Latest | Notes |
|---------|---------|--------|-------|
{{#OUTDATED_DEPS}}
| {{PACKAGE}} | {{CURRENT}} | {{LATEST}} | {{NOTES}} |
{{/OUTDATED_DEPS}}

---

## Next.js Specific Checks

### Version Check
- **Installed Version**: {{NEXTJS_VERSION}}
- **Latest Stable**: {{NEXTJS_LATEST}}
- **Known CVEs**: {{NEXTJS_CVES}}

### Configuration Review

| Check | Status | Notes |
|-------|--------|-------|
| Security headers configured | {{HEADERS_STATUS}} | {{HEADERS_NOTES}} |
| Image domains restricted | {{IMAGE_STATUS}} | {{IMAGE_NOTES}} |
| Server Actions protected | {{ACTIONS_STATUS}} | {{ACTIONS_NOTES}} |
| Environment variables secure | {{ENV_STATUS}} | {{ENV_NOTES}} |

---

## Recommendations Summary

### Immediate Actions (Critical/High)

1. {{IMMEDIATE_ACTION_1}}
2. {{IMMEDIATE_ACTION_2}}
3. {{IMMEDIATE_ACTION_3}}

### Short-term Improvements (Medium)

1. {{SHORTTERM_ACTION_1}}
2. {{SHORTTERM_ACTION_2}}
3. {{SHORTTERM_ACTION_3}}

### Best Practice Suggestions (Low/Info)

1. {{BESTPRACTICE_1}}
2. {{BESTPRACTICE_2}}
3. {{BESTPRACTICE_3}}

---

## Appendix

### A. OWASP Top 10:2025 Mapping

| Finding | OWASP Category |
|---------|----------------|
{{#OWASP_MAPPING}}
| {{FINDING}} | {{OWASP_CATEGORY}} |
{{/OWASP_MAPPING}}

### B. Tools Used

- Dependency Audit: npm audit / yarn audit
- Secret Scanner: custom pattern matching
- Pattern Scanner: regex-based static analysis
- Reference: OWASP Cheat Sheet Series

### C. Scan Configuration

{ "scanType": "{{SCAN_TYPE}}", "includePaths": {{INCLUDE_PATHS}}, "excludePaths": {{EXCLUDE_PATHS}}, "categories": {{CATEGORIES}} }

---

*Report generated by Next.js Security Scan Skill*
*Based on OWASP Top 10:2025 and industry best practices*

Authentication & Authorization Vulnerability Patterns

Overview

Authentication failures and broken access control are consistently ranked in the OWASP Top 10. These vulnerabilities can lead to unauthorized access, privilege escalation, and data breaches.

OWASP Classification

• A01:2025 - Broken Access Control
• A07:2025 - Authentication Failures
• CWEs: CWE-287, CWE-306, CWE-862, CWE-863

---

Missing Authentication in Server Actions

Critical Patterns

Severity: CRITICAL

// ❌ VULNERABLE - No auth check in Server Action
'use server'

export async function deleteUser(userId: string) {
  await db.user.delete({ where: { id: userId } });
  // Anyone can delete any user!
}

// ❌ VULNERABLE - No auth check in data mutation
'use server'

export async function updateProfile(data: ProfileData) {
  await db.profile.update({
    where: { id: data.id },
    data: data
  });
}

Detection Pattern: Look for Server Actions ('use server') without authentication checks.

Regex Pattern:

['"]use server['"][\s\S]*?export\s+(async\s+)?function\s+\w+

Then verify the function body contains auth checks.

Safe Alternative:

// ✅ SAFE - With authentication
'use server'

import { auth } from '@/lib/auth';

export async function deleteUser(userId: string) {
  const session = await auth();
  if (!session?.user) {
    throw new Error('Unauthorized');
  }

  // Also check authorization
  if (session.user.role !== 'admin') {
    throw new Error('Forbidden');
  }

  await db.user.delete({ where: { id: userId } });
}

---

Missing Authentication in API Routes

Critical Patterns

Severity: CRITICAL

// ❌ VULNERABLE - App Router API without auth
// app/api/users/route.ts
export async function DELETE(request: Request) {
  const { userId } = await request.json();
  await db.user.delete({ where: { id: userId } });
  return Response.json({ success: true });
}

// ❌ VULNERABLE - Pages Router API without auth
// pages/api/admin/users.ts
export default async function handler(req, res) {
  const users = await db.user.findMany();
  res.json(users);
}

Detection: Look for API route files without auth middleware or session checks.

Safe Alternative:

// ✅ SAFE - App Router with auth
import { auth } from '@/lib/auth';
import { NextResponse } from 'next/server';

export async function DELETE(request: Request) {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  const { userId } = await request.json();

  // Authorization check
  if (session.user.id !== userId && session.user.role !== 'admin') {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
  }

  await db.user.delete({ where: { id: userId } });
  return NextResponse.json({ success: true });
}

---

Insecure Direct Object Reference (IDOR)

Critical Patterns

Severity: HIGH

// ❌ VULNERABLE - No ownership check
export async function getDocument(docId: string) {
  return await db.document.findUnique({ where: { id: docId } });
  // Any user can access any document!
}

// ❌ VULNERABLE - Using user-provided ID without verification
export async function updateOrder(orderId: string, data: OrderData) {
  await db.order.update({
    where: { id: orderId },
    data
  });
}

Safe Alternative:

// ✅ SAFE - With ownership verification
export async function getDocument(docId: string) {
  const session = await auth();
  if (!session) throw new Error('Unauthorized');

  const document = await db.document.findUnique({
    where: {
      id: docId,
      userId: session.user.id  // Ownership check
    }
  });

  if (!document) {
    throw new Error('Document not found');
  }

  return document;
}

---

Weak Password Requirements

Patterns to Detect

Severity: MEDIUM

// ❌ VULNERABLE - No password validation
const password = formData.get('password');
await createUser({ email, password });

// ❌ VULNERABLE - Weak validation
if (password.length < 4) {
  throw new Error('Password too short');
}

Safe Alternative:

// ✅ SAFE - Strong password validation
import { z } from 'zod';

const passwordSchema = z.string()
  .min(12, 'Password must be at least 12 characters')
  .regex(/[A-Z]/, 'Must contain uppercase letter')
  .regex(/[a-z]/, 'Must contain lowercase letter')
  .regex(/[0-9]/, 'Must contain number')
  .regex(/[^A-Za-z0-9]/, 'Must contain special character');

// Or use zxcvbn for strength estimation
import zxcvbn from 'zxcvbn';
const result = zxcvbn(password);
if (result.score < 3) {
  throw new Error('Password is too weak');
}

---

Insecure Session Management

Patterns to Detect

Severity: HIGH

// ❌ VULNERABLE - Session token in URL
const url = `/dashboard?session=${sessionToken}`;

// ❌ VULNERABLE - Long session expiry
const session = await createSession({
  expiresIn: '365d'  // Too long!
});

// ❌ VULNERABLE - No secure cookie flags
res.setHeader('Set-Cookie', `session=${token}`);

Safe Alternative:

// ✅ SAFE - Proper cookie configuration
import { cookies } from 'next/headers';

cookies().set('session', token, {
  httpOnly: true,      // Prevent XSS access
  secure: true,        // HTTPS only
  sameSite: 'lax',     // CSRF protection
  maxAge: 60 * 60 * 24 // 24 hours max
});

---

Missing CSRF Protection

Patterns to Detect

Severity: HIGH

// ❌ VULNERABLE - Form without CSRF token (Pages Router)
<form action="/api/transfer" method="POST">
  <input name="amount" />
  <button type="submit">Transfer</button>
</form>

// ❌ VULNERABLE - State-changing GET request
export async function GET(request: Request) {
  const userId = request.nextUrl.searchParams.get('id');
  await db.user.delete({ where: { id: userId } });
}

Safe Alternative:

// ✅ SAFE - Server Actions have built-in CSRF protection
<form action={transferMoney}>
  <input name="amount" />
  <button type="submit">Transfer</button>
</form>

// ✅ SAFE - Use POST for mutations
export async function POST(request: Request) {
  // Mutations via POST only
}

---

JWT Vulnerabilities

Patterns to Detect

Severity: HIGH

// ❌ VULNERABLE - No algorithm verification
const decoded = jwt.decode(token);  // Never use decode() for verification!

// ❌ VULNERABLE - Algorithm confusion
jwt.verify(token, publicKey);  // Could accept 'none' algorithm

// ❌ VULNERABLE - Weak secret
const token = jwt.sign(payload, 'secret123');

// ❌ VULNERABLE - Sensitive data in payload
const token = jwt.sign({ password: user.password }, secret);

Safe Alternative:

// ✅ SAFE - Proper JWT verification
import jwt from 'jsonwebtoken';

const decoded = jwt.verify(token, process.env.JWT_SECRET!, {
  algorithms: ['HS256'],  // Explicit algorithm
  issuer: 'your-app',
  audience: 'your-api'
});

// ✅ SAFE - Use strong secret (256+ bits)
// Generate with: openssl rand -base64 32

---

Privilege Escalation

Patterns to Detect

Severity: CRITICAL

// ❌ VULNERABLE - User can set their own role
export async function updateUser(data: { id: string, role: string }) {
  await db.user.update({
    where: { id: data.id },
    data: { role: data.role }  // User controls role!
  });
}

// ❌ VULNERABLE - Mass assignment
export async function updateProfile(userId: string, data: any) {
  await db.user.update({
    where: { id: userId },
    data  // All fields from user input!
  });
}

Safe Alternative:

// ✅ SAFE - Allowlist fields
export async function updateProfile(userId: string, data: ProfileInput) {
  const session = await auth();
  if (session?.user.id !== userId) {
    throw new Error('Forbidden');
  }

  // Only allow specific fields
  await db.user.update({
    where: { id: userId },
    data: {
      name: data.name,
      bio: data.bio,
      // role is NOT included
    }
  });
}

---

Scan Checklist

• [ ] All Server Actions have authentication checks
• [ ] All API routes have authentication checks
• [ ] Authorization verifies resource ownership (IDOR)
• [ ] Password requirements meet minimum strength
• [ ] Session cookies use httpOnly, secure, sameSite
• [ ] JWT uses explicit algorithm verification
• [ ] No sensitive data in JWT payloads
• [ ] CSRF protection on all state-changing operations
• [ ] No mass assignment vulnerabilities
• [ ] Role/privilege changes require admin authorization

---

Recommended Libraries

Injection Vulnerability Patterns

Overview

Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query. This includes SQL injection, NoSQL injection, command injection, and LDAP injection.

OWASP Classification

• Category: A03:2025 - Injection
• CWEs: CWE-89 (SQL), CWE-78 (OS Command), CWE-943 (NoSQL)

---

SQL Injection

Critical Patterns

Severity: CRITICAL

// ❌ VULNERABLE - String concatenation
const query = "SELECT * FROM users WHERE id = " + userId;
const query = `SELECT * FROM users WHERE email = '${email}'`;

// ❌ VULNERABLE - Template literals in queries
db.query(`DELETE FROM posts WHERE id = ${postId}`);

// ❌ VULNERABLE - Raw queries with user input
prisma.$queryRaw`SELECT * FROM users WHERE name = ${name}`;
connection.query("SELECT * FROM products WHERE category = '" + category + "'");

Regex Patterns:

(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\s+.*\$\{
(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\s+.*\+\s*\w+
\.query\s*\(\s*['"`].*\$\{
\$queryRaw\s*`[^`]*\$\{

Safe Alternatives:

// ✅ SAFE - Parameterized queries (Prisma)
const user = await prisma.user.findUnique({
  where: { id: userId }
});

// ✅ SAFE - Prepared statements
const [rows] = await connection.execute(
  'SELECT * FROM users WHERE id = ?',
  [userId]
);

// ✅ SAFE - Prisma queryRaw with Prisma.sql
import { Prisma } from '@prisma/client';
const result = await prisma.$queryRaw(
  Prisma.sql`SELECT * FROM users WHERE id = ${userId}`
);

---

NoSQL Injection (MongoDB)

Critical Patterns

Severity: CRITICAL

// ❌ VULNERABLE - Direct object from user input
const user = await User.findOne({ username: req.body.username });
// Attacker can send: { "username": { "$gt": "" } }

// ❌ VULNERABLE - $where with user input
db.collection.find({ $where: `this.name == '${userInput}'` });

// ❌ VULNERABLE - Aggregation with user input
db.collection.aggregate([{ $match: JSON.parse(userInput) }]);

Regex Patterns:

\.(find|findOne|findMany|updateOne|deleteOne)\s*\(\s*\{[^}]*req\.(body|query|params)
\$where\s*:.*\$\{
JSON\.parse\s*\([^)]*req\.(body|query|params)

Safe Alternatives:

// ✅ SAFE - Validate and sanitize input
import mongoSanitize from 'express-mongo-sanitize';

// ✅ SAFE - Type validation with Zod
import { z } from 'zod';
const schema = z.object({
  username: z.string().min(1).max(50)
});
const { username } = schema.parse(req.body);
const user = await User.findOne({ username });

// ✅ SAFE - Explicit field access
const user = await User.findOne({
  username: String(req.body.username)
});

---

Command Injection

Critical Patterns

Severity: CRITICAL

// ❌ VULNERABLE - exec with user input
import { exec } from 'child_process';
exec(`ls ${userInput}`);
exec('grep ' + searchTerm + ' /var/log/app.log');

// ❌ VULNERABLE - execSync
execSync(`convert ${filename} output.png`);

// ❌ VULNERABLE - spawn with shell: true
spawn('sh', ['-c', `echo ${userInput}`], { shell: true });

Regex Patterns:

exec(Sync)?\s*\([^)]*\$\{
exec(Sync)?\s*\([^)]*\+
spawn\s*\([^)]*shell\s*:\s*true

Safe Alternatives:

// ✅ SAFE - Use spawn with array arguments (no shell)
import { spawn } from 'child_process';
spawn('ls', ['-la', sanitizedPath]);

// ✅ SAFE - Use execFile
import { execFile } from 'child_process';
execFile('convert', [filename, 'output.png']);

// ✅ SAFE - Validate input against allowlist
const allowedCommands = ['status', 'version', 'help'];
if (!allowedCommands.includes(userCommand)) {
  throw new Error('Invalid command');
}

---

Path Traversal

Critical Patterns

Severity: HIGH

// ❌ VULNERABLE - Direct path concatenation
const filePath = `/uploads/${req.params.filename}`;
fs.readFile(path.join(baseDir, userInput));

// ❌ VULNERABLE - No validation
res.sendFile(req.query.file);

Regex Patterns:

(readFile|writeFile|readFileSync|writeFileSync)\s*\([^)]*req\.(body|query|params)
sendFile\s*\([^)]*req\.(body|query|params)
path\.join\s*\([^)]*req\.(body|query|params)

Safe Alternatives:

// ✅ SAFE - Validate and normalize path
import path from 'path';

const safePath = (baseDir: string, userInput: string): string => {
  const normalized = path.normalize(userInput).replace(/^(\.\.[\/\\])+/, '');
  const fullPath = path.join(baseDir, normalized);

  // Ensure path stays within base directory
  if (!fullPath.startsWith(path.resolve(baseDir))) {
    throw new Error('Path traversal detected');
  }
  return fullPath;
};

// ✅ SAFE - Use allowlist
const allowedFiles = ['report.pdf', 'summary.pdf'];
if (!allowedFiles.includes(filename)) {
  throw new Error('File not allowed');
}

---

LDAP Injection

Critical Patterns

Severity: HIGH

// ❌ VULNERABLE
const filter = `(uid=${username})`;
const filter = '(cn=' + searchTerm + ')';

Regex Pattern:

\([\w]+=.*\$\{
\([\w]+=.*\+

Safe Alternative:

// ✅ SAFE - Escape special characters
const escapeLDAP = (str: string): string => {
  return str.replace(/[\\*()\\x00]/g, (char) => '\\' + char.charCodeAt(0).toString(16));
};
const filter = `(uid=${escapeLDAP(username)})`;

---

Header Injection

Critical Patterns

Severity: MEDIUM

// ❌ VULNERABLE - User input in headers
res.setHeader('X-Custom', userInput);
res.redirect(req.query.redirect);  // Open redirect

Regex Pattern:

setHeader\s*\([^,]+,\s*req\.(body|query|params)
redirect\s*\(\s*req\.(body|query|params)

---

Scan Checklist

• [ ] Search for string concatenation in SQL queries
• [ ] Search for template literals in database queries
• [ ] Search for $queryRaw without Prisma.sql
• [ ] Search for MongoDB queries with direct user input
• [ ] Search for $where operator usage
• [ ] Search for exec, execSync, spawn with user input
• [ ] Search for file operations with user-controlled paths
• [ ] Search for res.redirect with user input
• [ ] Verify parameterized queries are used throughout
• [ ] Verify input validation with Zod or similar

---

Recommended Libraries

Next.js Specific Security Vulnerabilities

Overview

Next.js has specific security considerations due to its hybrid rendering model, Server Components, Server Actions, and middleware architecture. This document covers Next.js-specific vulnerabilities and recent CVEs.

---

Recent Critical CVEs

CVE-2025-29927 - Middleware Authorization Bypass

Severity: CRITICAL (CVSS 9.1) Affected Versions: All versions before patches Status: Patched

Description: Attackers can bypass middleware-based security checks by adding an x-middleware-subrequest header to requests.

Detection:

// ❌ VULNERABLE - Relying solely on middleware for auth
// middleware.ts
export function middleware(request: NextRequest) {
  const token = request.cookies.get('session');
  if (!token) {
    return NextResponse.redirect('/login');
  }
}

// No additional auth check in the protected route

Remediation: 1. Upgrade Next.js to patched version 2. Never rely solely on middleware for authentication 3. Implement defense in depth

// ✅ SAFE - Multi-layer authentication
// middleware.ts (first layer)
export function middleware(request: NextRequest) {
  const token = request.cookies.get('session');
  if (!token) {
    return NextResponse.redirect('/login');
  }
}

// page.tsx or API route (second layer)
export default async function ProtectedPage() {
  const session = await auth();
  if (!session) {
    redirect('/login');
  }
  // ...
}

---

CVE-2025-55182 / CVE-2025-66478 - React Server Components Vulnerability

Severity: CRITICAL Affected Versions: Next.js ≥14.3.0-canary.77, ≥15, ≥16 Status: Patched

Description: Remote code execution vulnerability in React Server Components (react-server-dom-*).

Remediation: 1. Upgrade to patched Next.js version immediately 2. Rotate all application secrets after patching 3. Review server logs for suspicious activity

---

Server Components Data Exposure

Patterns to Detect

Severity: HIGH

// ❌ VULNERABLE - Passing sensitive data to Client Components
// Server Component
async function UserProfile() {
  const user = await db.user.findUnique({
    include: { passwordHash: true }  // Includes sensitive data!
  });

  return <ClientProfileCard user={user} />;  // Leaked to client!
}

// ❌ VULNERABLE - Exposing API keys
async function DataFetcher() {
  const data = await fetch(url, {
    headers: { 'Authorization': process.env.API_KEY }
  });

  // If this becomes a Client Component, API_KEY might leak
  return <div>{JSON.stringify(data)}</div>;
}

Safe Alternative:

// ✅ SAFE - Only pass necessary data
async function UserProfile() {
  const user = await db.user.findUnique({
    select: {
      id: true,
      name: true,
      email: true
      // No sensitive fields
    }
  });

  return <ClientProfileCard user={user} />;
}

---

Server Actions Security Issues

Missing Server Action Validation

Severity: HIGH

// ❌ VULNERABLE - No input validation
'use server'

export async function createPost(formData: FormData) {
  const title = formData.get('title');
  const content = formData.get('content');

  await db.post.create({
    data: { title, content }  // Unvalidated input!
  });
}

Safe Alternative:

// ✅ SAFE - With validation
'use server'

import { z } from 'zod';

const postSchema = z.object({
  title: z.string().min(1).max(200),
  content: z.string().min(1).max(10000)
});

export async function createPost(formData: FormData) {
  const result = postSchema.safeParse({
    title: formData.get('title'),
    content: formData.get('content')
  });

  if (!result.success) {
    return { error: result.error.flatten() };
  }

  await db.post.create({ data: result.data });
}

Server Action Size Limits

// next.config.js - Set appropriate limits
module.exports = {
  experimental: {
    serverActions: {
      bodySizeLimit: '2mb',  // Prevent DoS via large payloads
      allowedOrigins: ['example.com']  // CSRF protection
    }
  }
}

---

Environment Variable Exposure

Patterns to Detect

Severity: CRITICAL

// ❌ VULNERABLE - Server env in client code
// Client Component
'use client'

export function ApiCaller() {
  // This won't work AND indicates a security misunderstanding
  const apiKey = process.env.API_KEY;
}

// ❌ VULNERABLE - Exposing server vars via NEXT_PUBLIC_
// .env
NEXT_PUBLIC_DATABASE_URL=postgresql://...  // WRONG!
NEXT_PUBLIC_API_SECRET=sk-...  // WRONG!

Detection Regex:

NEXT_PUBLIC_.*SECRET
NEXT_PUBLIC_.*KEY
NEXT_PUBLIC_.*PASSWORD
NEXT_PUBLIC_.*TOKEN
NEXT_PUBLIC_.*DATABASE

Safe Pattern:

# .env - Server-only (no NEXT_PUBLIC_ prefix)
DATABASE_URL=postgresql://...
API_SECRET=sk-...

# .env - Client-safe only
NEXT_PUBLIC_APP_URL=https://example.com
NEXT_PUBLIC_ANALYTICS_ID=GA-123

---

Security Headers Configuration

Missing Headers

Severity: MEDIUM

// ❌ MISSING - No security headers configured
// next.config.js
module.exports = {
  // No headers configuration
}

Safe Alternative:

// ✅ SAFE - Comprehensive security headers
// next.config.js
const securityHeaders = [
  {
    key: 'X-DNS-Prefetch-Control',
    value: 'on'
  },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload'
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN'
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff'
  },
  {
    key: 'Referrer-Policy',
    value: 'origin-when-cross-origin'
  },
  {
    key: 'Content-Security-Policy',
    value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
  }
];

module.exports = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: securityHeaders
      }
    ];
  }
};

---

Image Component Vulnerabilities

Patterns to Detect

Severity: MEDIUM

// ❌ VULNERABLE - Unrestricted remote images
// next.config.js
module.exports = {
  images: {
    remotePatterns: [
      { protocol: 'https', hostname: '**' }  // Too permissive!
    ]
  }
}

// ❌ VULNERABLE - User-controlled image src
<Image src={userProvidedUrl} alt="User image" />

Safe Alternative:

// ✅ SAFE - Restricted domains
module.exports = {
  images: {
    remotePatterns: [
      { protocol: 'https', hostname: 'cdn.example.com' },
      { protocol: 'https', hostname: 'images.example.com' }
    ]
  }
}

// ✅ SAFE - Validate image URLs
const isAllowedImageHost = (url: string) => {
  const allowed = ['cdn.example.com', 'images.example.com'];
  try {
    const { hostname } = new URL(url);
    return allowed.includes(hostname);
  } catch {
    return false;
  }
};

---

Redirect and Rewrite Vulnerabilities

Open Redirect

Severity: MEDIUM

// ❌ VULNERABLE - Open redirect
// app/api/redirect/route.ts
export async function GET(request: Request) {
  const url = request.nextUrl.searchParams.get('url');
  return NextResponse.redirect(url!);  // Open redirect!
}

// ❌ VULNERABLE - redirect() with user input
import { redirect } from 'next/navigation';

export default function Page({ searchParams }) {
  if (someCondition) {
    redirect(searchParams.next);  // Open redirect!
  }
}

Safe Alternative:

// ✅ SAFE - Validate redirect URL
const ALLOWED_HOSTS = ['example.com', 'app.example.com'];

function safeRedirect(url: string): string {
  try {
    const parsed = new URL(url, 'https://example.com');
    if (ALLOWED_HOSTS.includes(parsed.hostname)) {
      return parsed.toString();
    }
  } catch {}
  return '/';  // Default to home
}

export async function GET(request: Request) {
  const url = request.nextUrl.searchParams.get('url') || '/';
  return NextResponse.redirect(safeRedirect(url));
}

---

Scan Checklist

• [ ] Next.js version is up to date (check for CVEs)
• [ ] Middleware is not sole authentication layer
• [ ] Server Components don't leak sensitive data to client
• [ ] Server Actions have input validation
• [ ] Server Actions have authentication checks
• [ ] No sensitive env vars use NEXT_PUBLIC_ prefix
• [ ] Security headers are configured
• [ ] Image domains are restricted
• [ ] No open redirects
• [ ] serverActions.bodySizeLimit is configured
• [ ] serverActions.allowedOrigins is configured

---

Version Check Commands

# Check Next.js version
npm list next

# Check for outdated packages
npm outdated

# Check for known vulnerabilities
npm audit

OWASP Top 10:2025 Quick Reference

Overview

The OWASP Top 10 is a standard awareness document representing the most critical security risks to web applications. This is the 2025 version with updated categories based on current threat landscape.

---

A01:2025 - Broken Access Control

Risk: Users acting outside their intended permissions.

Common Vulnerabilities:

• Missing authentication on endpoints
• Missing authorization checks (IDOR)
• Privilege escalation
• CORS misconfiguration
• Forced browsing to authenticated pages

Detection Patterns:

// Missing auth check
export async function DELETE(request) { ... }

// Missing ownership verification
const doc = await db.doc.findUnique({ where: { id } });  // No user filter

Prevention:

• Deny by default
• Implement access control mechanisms once, reuse throughout
• Log access control failures

---

A02:2025 - Cryptographic Failures

Risk: Exposure of sensitive data due to weak cryptography.

Common Vulnerabilities:

• Transmitting data in clear text (HTTP)
• Using weak/deprecated algorithms (MD5, SHA1, DES)
• Hardcoded encryption keys
• Missing encryption for sensitive data

Detection Patterns:

// Weak hashing
const hash = crypto.createHash('md5').update(password).digest('hex');

// Hardcoded keys
const SECRET_KEY = 'my-secret-key-123';

Prevention:

• Use TLS for all data transmission
• Use strong algorithms (AES-256, SHA-256+, bcrypt)
• Store secrets in environment variables

---

A03:2025 - Software Supply Chain Failures (NEW)

Risk: Vulnerabilities introduced through dependencies.

Common Vulnerabilities:

• Using packages with known CVEs
• No dependency verification
• Typosquatting attacks
• Compromised build pipelines

Detection:

npm audit
yarn audit
npx snyk test

Prevention:

• Regular dependency audits
• Lock file verification
• Use Dependabot or similar
• Verify package integrity

---

A04:2025 - Security Misconfiguration

Risk: Insecure default configurations or incomplete setup.

Common Vulnerabilities:

• Unnecessary features enabled
• Default accounts/passwords
• Verbose error messages
• Missing security headers
• Outdated software

Detection Patterns:

// Verbose errors in production
if (error) {
  res.status(500).json({ error: error.stack });  // Exposes internals
}

// Missing security headers
// No Content-Security-Policy, X-Frame-Options, etc.

Prevention:

• Minimal platform, remove unused features
• Review and update configurations regularly
• Implement security headers

---

A05:2025 - Injection

Risk: Untrusted data sent to an interpreter.

Types:

• SQL Injection
• NoSQL Injection
• Command Injection
• LDAP Injection
• XSS (Cross-Site Scripting)

Detection Patterns:

// SQL Injection
query(`SELECT * FROM users WHERE id = ${userId}`);

// Command Injection
exec(`ls ${userInput}`);

// XSS
element.innerHTML = userInput;

Prevention:

• Use parameterized queries
• Validate and sanitize input
• Use ORM/ODM properly
• Escape output

---

A06:2025 - Insecure Design

Risk: Security flaws in the application architecture.

Common Issues:

• No threat modeling
• Missing security requirements
• Lack of secure design patterns
• No rate limiting

Examples:

• Password reset via security questions only
• No brute force protection
• Trust boundaries not defined

Prevention:

• Threat modeling during design
• Secure design patterns
• Reference architectures
• Unit and integration testing for security

---

A07:2025 - Authentication Failures

Risk: Identity, authentication, or session management flaws.

Common Vulnerabilities:

• Weak passwords allowed
• Credential stuffing susceptibility
• Missing MFA
• Session fixation
• Improper session invalidation

Detection Patterns:

// Weak password validation
if (password.length >= 4) { ... }

// Session not invalidated on logout
function logout() {
  redirect('/login');  // Session still valid!
}

Prevention:

• Implement MFA
• Strong password requirements
• Secure session management
• Account lockout policies

---

A08:2025 - Software and Data Integrity Failures

Risk: Code/data modifications without verification.

Common Vulnerabilities:

• Insecure deserialization
• CI/CD pipeline vulnerabilities
• Auto-update without verification
• Unsigned code/packages

Detection Patterns:

// Unsafe deserialization
const data = JSON.parse(userInput);  // Then using as trusted
const obj = eval('(' + userInput + ')');

Prevention:

• Digital signatures for code/updates
• Integrity verification for CI/CD
• Review code changes
• Serialization validation

---

A09:2025 - Security Logging and Alerting Failures

Risk: Inability to detect, escalate, or respond to attacks.

Common Issues:

• No logging of authentication events
• No alerting on suspicious activity
• Logs stored only locally
• Sensitive data in logs

Detection:

// No logging
export async function login(credentials) {
  // No audit trail of login attempts
}

// Sensitive data in logs
console.log(`User ${email} logged in with password ${password}`);

Prevention:

• Log authentication events
• Log access control failures
• Centralized log management
• Alerting thresholds

---

A10:2025 - Mishandling of Exceptional Conditions (NEW)

Risk: Improper error handling leading to security issues.

Common Vulnerabilities:

• Failing open instead of closed
• Information disclosure in errors
• Uncaught exceptions
• Race conditions

Detection Patterns:

// Failing open
try {
  verifyToken(token);
} catch {
  // Silently continues - user is now "authenticated"!
}

// Information disclosure
catch (error) {
  return res.json({ error: error.message, stack: error.stack });
}

Prevention:

• Fail securely (deny by default)
• Generic error messages to users
• Detailed logging internally
• Handle all exceptions

---

Quick Reference Table

---

Resources

• OWASP Top 10:2025
• OWASP Cheat Sheet Series
• OWASP Testing Guide
• OWASP ASVS

XSS (Cross-Site Scripting) Vulnerability Patterns

Overview

XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users. In React/Next.js applications, XSS typically occurs when user input is rendered without proper sanitization.

OWASP Classification

• Category: A03:2021 - Injection (includes XSS)
• CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)

---

Critical Patterns to Detect

1. dangerouslySetInnerHTML (React/Next.js)

Severity: CRITICAL

// ❌ VULNERABLE - Direct user input
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// ❌ VULNERABLE - Data from API without sanitization
<div dangerouslySetInnerHTML={{ __html: data.content }} />

// ❌ VULNERABLE - Template literal with user input
<div dangerouslySetInnerHTML={{ __html: `<p>${userMessage}</p>` }} />

Regex Pattern:

dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:

Safe Alternative:

import DOMPurify from 'dompurify';

// ✅ SAFE - Sanitized input
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />

---

2. innerHTML Assignment

Severity: CRITICAL

// ❌ VULNERABLE
element.innerHTML = userInput;
document.getElementById('output').innerHTML = data;

// ❌ VULNERABLE - Template literal
element.innerHTML = `<span>${userContent}</span>`;

Regex Pattern:

\.innerHTML\s*=

Safe Alternative:

// ✅ SAFE - Use textContent for plain text
element.textContent = userInput;

// ✅ SAFE - Use DOMPurify for HTML
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

---

3. outerHTML Assignment

Severity: CRITICAL

// ❌ VULNERABLE
element.outerHTML = userInput;

Regex Pattern:

\.outerHTML\s*=

---

4. document.write / document.writeln

Severity: CRITICAL

// ❌ VULNERABLE
document.write(userInput);
document.writeln('<script>' + userCode + '</script>');

Regex Pattern:

document\.write(ln)?\s*\(

---

5. eval() and Similar Functions

Severity: CRITICAL

// ❌ VULNERABLE - Direct eval
eval(userInput);

// ❌ VULNERABLE - Function constructor
new Function(userInput)();

// ❌ VULNERABLE - setTimeout/setInterval with string
setTimeout(userInput, 1000);
setInterval('alert(' + userInput + ')', 1000);

Regex Patterns:

eval\s*\(
new\s+Function\s*\(
setTimeout\s*\(\s*['"`]
setInterval\s*\(\s*['"`]

---

6. URL-based XSS

Severity: HIGH

// ❌ VULNERABLE - javascript: protocol
<a href={userInput}>Click</a>  // userInput could be "javascript:alert(1)"

// ❌ VULNERABLE - Unvalidated redirect
window.location.href = userInput;
window.location = params.redirect;

// ❌ VULNERABLE - iframe src
<iframe src={userInput} />

Regex Patterns:

href\s*=\s*\{[^}]*\}
window\.location(\.href)?\s*=
<iframe[^>]*src\s*=\s*\{

Safe Alternative:

// ✅ SAFE - Validate URL protocol
const isValidUrl = (url: string) => {
  try {
    const parsed = new URL(url);
    return ['http:', 'https:'].includes(parsed.protocol);
  } catch {
    return false;
  }
};

{isValidUrl(userInput) && <a href={userInput}>Click</a>}

---

7. Event Handler Injection

Severity: HIGH

// ❌ VULNERABLE - Dynamic event handlers
<button onClick={userInput}>Click</button>

// ❌ VULNERABLE - setAttribute for events
element.setAttribute('onclick', userInput);
element.setAttribute('onerror', userInput);

Regex Pattern:

setAttribute\s*\(\s*['"`]on\w+['"`]

---

8. Script Injection via src

Severity: CRITICAL

// ❌ VULNERABLE
<script src={userInput}></script>

// ❌ VULNERABLE - Dynamic script loading
const script = document.createElement('script');
script.src = userInput;
document.body.appendChild(script);

Regex Pattern:

<script[^>]*src\s*=\s*\{
createElement\s*\(\s*['"`]script['"`]\s*\)

---

React-Specific Considerations

Safe by Default

React escapes values in JSX by default:

// ✅ SAFE - React escapes this automatically
<div>{userInput}</div>
<span>{data.content}</span>

Exception: dangerouslySetInnerHTML

The only way to inject raw HTML in React is through dangerouslySetInnerHTML, which should always be flagged for review.

---

Scan Checklist

• [ ] Search for dangerouslySetInnerHTML usage
• [ ] Search for .innerHTML assignments
• [ ] Search for .outerHTML assignments
• [ ] Search for document.write calls
• [ ] Search for eval() usage
• [ ] Search for new Function() usage
• [ ] Search for dynamic href with user input
• [ ] Search for window.location assignments
• [ ] Search for dynamic script/iframe sources
• [ ] Verify DOMPurify or similar sanitization is used where needed

---

Remediation Libraries