Readit News logoReadit News
Rauchg commented on RCE Vulnerability in React and Next.js   github.com/vercel/next.js... · Posted by u/rayhaanj
karimf · a month ago
> Projects hosted on Vercel benefit from platform-level protections that already block malicious request patterns associated with this issue.

https://vercel.com/changelog/cve-2025-55182

> Cloudflare WAF proactively protects against React vulnerability

https://blog.cloudflare.com/waf-rules-react-vulnerability/

Rauchg · a month ago
We collaborated with many industry partners to proactively deploy mitigations due to the severity of the issue.

We still strongly recommend everyone to upgrade their Next, React, and other React meta-frameworks (peer)dependencies immediately.

Rauchg commented on Next.js is infuriating   blog.meca.sh/3lxoty3shjc2... · Posted by u/Bogdanp
Rauchg · 4 months ago
Heard and appreciate the feedback. We’re well aware of the DX papercuts in Middleware. With 15.5 we made a big step in supporting Node runtime[1] which addresses a slew of issues people have reported over time.

If I went back in time, I would have called it Routing Middleware or Routing Handler. A specific hook to intercept during the routing phase, which can be delivered to the CDN edge for specialized providers. It’s also a somewhat advanced escape hatch.

Since OP mentions logging, it’s worth noting that for instrumentation and observability we’ve embraced OpenTelemetry and have an instrumentation.ts convention[2]

[1] https://nextjs.org/blog/next-15-5#nodejs-middleware-stable

[2] https://nextjs.org/docs/app/api-reference/file-conventions/i...

Rauchg commented on Ask HN: Why buy domains and 301 redirect them to me?    · Posted by u/HughParry
Rauchg · a year ago
It’s possible `/` redirects but other hidden routes phish. If someone gets e.g.: a fake password reset email, it might help the attacker bypass sanity checks users make.
Rauchg commented on Falsehoods programmers believe about TCP   lwn.net/Articles/990281/... · Posted by u/todsacerdoti
LudwigNagasena · a year ago
Falsehoods programmers believe: TCP/IP can be coherently mapped to the OSI model.
Rauchg · a year ago
Falsehoods programmers believe: the OSI model
Rauchg commented on Show HN: A fast OSS voice assistant   swift-ai.vercel.app/... · Posted by u/Rauchg
vaasuu · a year ago
Looking at the git repo (https://github.com/ai-ng/swift), it was made by some web developer, not Vercel. Likely OP (Vercel CEO) just made a mistake posting it as a "Show HN".
Rauchg · a year ago
I've been acting mostly as the 'ideas guy' and helping with the architecture / QA. It's a great way for me to dogfood Vercel and build empathy as a user in an external org, using external services.

u/Rauchg

KarmaCake day3566December 8, 2009
About
Guillermo Rauch. https://twitter.com/rauchg https://vercel.com
View Original