Top all-time · #12324
zhero_web_security
Personal blog · zhero-web-sec.github.io/research-and-thingssecurityprogramming
zhero_web_security is a personal blog at zhero-web-sec.github.io about security and programming. Since 2024, 6 different Hacker News readers have linked it 6 times, most often “Next.js and the corrupt middleware: the authorizing artifact”. It is still writing: the last post was on 2025-08-26, and you can follow it by feed.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
Security research write-ups by zhero_web_security, linked by HN readers for technical details of the Next.js middleware authorization bypass and its fix.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Next.js and the corrupt middleware: the authorizing artifact3 people · 3 mentions · first linked 2025-03-23
What Hacker News says?
The post from the reporters is much more useful for this: https://zhero-web-sec.github.io/research-and-things/nextjs-a...
Comment linking /research-and-things/nextjs-and-the-corrupt-middleware
on “Next.js version 15.2.3 has been released to address a security vulnerability”Submitted Next.js and the corrupt middleware: the authorizing artifact as a story · 94 points
HN discussionMore details here: https://zhero-web-sec.github.io/research-and-things/nextjs-a... Hat tip ash: https://news.ycombinator.com/item?id=43451485
Comment linking /research-and-things/nextjs-and-the-corrupt-middleware
on “Authorization Bypass in Next.js Middleware”Submitted React Router and the Remix'ed path: CVE-2025-31137 as a story · 3 points
HN discussionSubmitted Next.js and cache poisoning: a quest for the black hole – zhero_web_security as a story · 2 points
HN discussionSubmitted Re: Cache: 0-click SXSS on Next.js via reflected headers as a story · 1 points
HN discussion
