next js security exploit