Wildcard Next.js Image Config Can Expose Your Server to SSRF Attacks

·1 views

A common but risky misconfiguration in Next.js sets the remotePatterns hostname to a wildcard, allowing any HTTPS URL to be fetched server-side through the built-in image optimization endpoint. Because the fetch originates from the server itself, attackers can exploit this to probe internal services — such as admin panels or cloud metadata endpoints — that are otherwise unreachable from the public internet. This is a classic Server-Side Request Forgery (SSRF) vulnerability, and cloud metadata endpoints like 169.254.169.254 have been targeted this way in real-world attacks to steal instance credentials. The recommended fix is to replace the wildcard with an explicit allowlist of only the trusted image hostnames your application actually uses. For apps handling user-generated content from unpredictable domains, developers are advised to validate and store image sources rather than defaulting to an open wildcard.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer tool lets cheap AI coding agents consult stronger models for hard problems

A developer has released ask-fable, an open-source MCP server designed to give budget AI coding agents on-demand access to more powerful reasoning models only when needed. The tool integrates with Claude Code and other MCP clients, allowing a cheaper, faster model to handle routine code writing while delegating complex problems — such as concurrency bugs or architectural decisions — to stronger models. Ask-fable offers four query modes: a standard single-model query, a council mode that polls multiple models and synthesizes their answers, a chained pipeline mode, and an adversarial debate mode for major design forks. The system supports a wide range of AI backends including Anthropic, Gemini, GPT, DeepSeek, and Grok, with gateway support for hundreds of additional models via OpenRouter. A built-in guard layer restricts the tool to software reasoning tasks, rejecting off-topic or offensive-security requests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Linux's 'cat' Command Is Misused and What to Use Instead

The 'cat' command, one of the first tools Linux users learn, was originally designed in 1971 by Ken Thompson and Dennis Ritchie to concatenate multiple files into a single stream — not to view individual files. Despite this, decades of tutorials have entrenched 'cat' as a default file viewer, a habit that causes real problems in production environments. When used on large log files or piped unnecessarily into other commands, it can freeze terminals, waste CPU cycles, and add kernel overhead. Modern CLI alternatives offer advantages like syntax highlighting, git-aware context, and better performance for interactive file inspection. Understanding the original purpose of 'cat' and adopting purpose-built tools can significantly improve how developers and administrators work on the Linux command line.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Business Growth Quietly Breaks Software That Once Worked Fine

Freelance software engineer Ayman Atif describes a recurring challenge in business software: applications that function well at launch begin to degrade as the business scales. A system handling a few hundred records may slow significantly when that number reaches tens of thousands, even without any code changes. The problem is compounded when users expect desktop-like behavior — such as viewing thousands of records in grids without pagination — placing simultaneous demands on the database, server, and browser. Atif notes that the instinct to fix the most visible symptom is often misleading, and that tracing the full request path from database to user interaction yields better results. The core issue, he argues, is that original design assumptions stop holding true as real-world usage grows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Arduino VENTUNO Q Combines Edge AI and Real-Time Microcontroller in One Board

Arduino has introduced the VENTUNO Q, a development board that pairs a Qualcomm Dragonwing IQ8 processor with an STM32H5 microcontroller to handle both AI inference and real-time physical control. The Dragonwing side manages neural-network workloads using its NPU, CPU, and GPU, while the STM32H5 handles time-sensitive operations such as motor control and GPIO. The board ships with 16 GB of LPDDR5 RAM, 64 GB of eMMC storage, and supports Ubuntu, Zephyr, and ROS 2, along with compatibility with Arduino UNO shields and Raspberry Pi accessories. Arduino positions the device for local large language models, computer vision, and speech applications, reducing dependence on cloud connectivity and keeping data processing on-device. The platform targets developers working across embedded programming, Linux tooling, and edge AI who want a single integrated system rather than multiple separate devices.

0 comments Read more at DEV Community