Security Advisory: Next.js Denial of Service vulnerability in redirect misconfiguration

• Project: Next.js
• Security Risk: Less Critical
• Vulnerability: Denial of Service (DoS)
• Category: OWASP A05:2021 – Security Misconfiguration
• Affected versions: all Next.js versions, for example 15.0.3

Note: This vulnerability has been disclosed privately to the Vercel Security Team. They decided that this is a misconfiguration issue and not an inherent security issue.

Here are the slides of my Drupal Dev Days presentation about D7Security in Bourgas. The recording will hopefully follow soon!

Here are the slides and a recording of my Drupal Austria Meetup presentation about D7Security.

Here is the video of my appearance on the Drupal 7 end of life podcast, talking about plans for the D7Security group. Thank you Mark Dorison and Chris Free from Chromatic for the recording!

Update: The D7Security group is now established at gitlab.com/d7security and d7security.org!

The Drupal Security Team has announced in PSA-2023-06-07 that unsupported Drupal 7 modules/themes cannot be supported again. I'm proposing to create a D7Security team on Gitlab.com that can provide security fixes for those unsupported modules. A small update module can then notify Drupal 7 site owners when new security releases are available on Gitlab.com.

Screenshot of Ubuntu's update manager popping up during the movie "Tank Girl."

Ubuntu's graphical update manager pops up every time you need to install updates. That can be annoying when you are watching a movie or doing other things and don't want to be bothered all the time. Yes, I want to always apply all updates from all sources, but please do it silently. Here is a small script I use to do that with Anacron.

Here is the video of my Russmedia CTO & product meetup talk "Pull Request Review best practices".

Here are the slides and the video of my DrupalCon Amsterdam 2019 talk "Find security vulnerabilities through code review".

I converted my old blog posts from Drupal to static files and now I'm trying out Zola. The static files are hosted on Github Pages.