next js security bug