In March 2025, a critical Next.js vulnerability (CVE-2025-29927, rated 9.1) let attackers skip middleware checks by sending one internal header (GitHub advisory). Apps that did all their authorization in middleware were exposed until they patched. Vercel's postmortem noted that apps hosted on Vercel were not affected, while self-hosted apps were (Vercel). That incident makes a very good Next.js interview question. Ask a candidate where auth checks belong in a Next.js app. Their answer tells you whether they understand the framework or just use it.
Key Takeaways
- Next.js is a full-stack framework now. Hire for server-side judgment on top of React skills.
- Screen for the server/client component boundary, caching behavior, and where security checks live.
- Next.js 15 changed caching defaults. Ask candidates what changed and why it matters.
- Plenty of React developers list Next.js. Far fewer have run it in production with real traffic.
Next.js Is a Backend Too
Since Next.js 13.4 (May 2023), the App Router has been stable and recommended for new apps (Next.js blog). In the App Router, layouts and pages are Server Components by default (Next.js docs). That means your "frontend developer" is writing code that runs on your server, talks to your database, and handles secrets.
Three consequences for hiring:
The `'use client'` line matters. Once a file is marked with it, everything it imports goes into the browser bundle. A careless boundary ships server code and bloats the page. A strong candidate can explain where they put the line and why.
Secrets can leak. Only environment variables prefixed with `NEXT_PUBLIC_` reach the client, and the `server-only` package makes the build fail if server code is imported on the client (same docs). Ask whether they use it.
Server Actions are endpoints. The Next.js team itself wrote: "You should still treat Server Actions as public HTTP endpoints" (Next.js 15 blog). Any action that changes data needs its own authorization check.
Caching: The Question Most Candidates Miss
Next.js 15 (October 2024) reversed a default that confused many teams: `fetch` requests, `GET` route handlers, and client navigations are no longer cached by default (Next.js 15 blog). The same release made `cookies`, `headers`, and `params` async, a breaking change that forced a lot of code edits during upgrades.
A candidate who has upgraded a real app from 14 to 15 will remember both. One who has only built demo apps usually won't.
| Question | Weak answer | Strong answer |
|---|---|---|
| "Where do you check authorization?" | "In middleware" | In the data layer and every Server Action, with middleware (`proxy.ts` since Next.js 16) as an extra layer at most |
| "Why is this page showing stale data?" | "Clear the cache" | Walks through fetch caching, revalidation, and the version you're on |
| "When do you use `'use client'`?" | "When something breaks" | Only for state, event handlers, and browser APIs, as low in the tree as possible |
| "How do you deploy it?" | "Push to Vercel" | Knows the tradeoffs of Vercel vs self-hosting, including the middleware CVE |
Next.js 16 then renamed the `middleware` file convention to `proxy` (Next.js docs), and the docs now describe it as a feature to use as a last resort. Caching changed again in the same release (Next.js 16 blog). A candidate on the current version should know the rename, and should still keep authorization in the data layer. Ask which major version they upgraded most recently, and what broke.
A Concrete Version
A Series A proptech startup self-hosts its Next.js 14 app in containers. Their admin dashboard checks roles in `middleware.ts` and nowhere else. After the March 2025 advisory, their contractor patches the version and moves on.
A senior Next.js engineer would do more. Patch first, since the fixed versions are listed in the advisory (for 14.x, 14.2.25). Then add authorization checks inside the server-side data functions and every Server Action that writes data, so a future middleware bug can't expose the admin area again. Then write two integration tests that call the admin endpoints as a normal user and expect a 403. Total effort: a few days. The result: the next middleware bug becomes a non-event for this app.
That's the difference between patching a vulnerability and fixing the design that made it dangerous.
The Honest Counterpoint
Next.js is a big framework that changes often, and some teams don't need it. A single-page internal dashboard behind a login has no SEO needs and may be simpler as a plain React app with a separate API. Our Next.js vs Remix comparison covers alternatives.
The pool is also narrower than it looks. In Stack Overflow's 2025 survey, 21.5% of professional developers used Next.js against 46.9% for React (Stack Overflow). Many React developers have touched Next.js without owning the server side of it. If the role involves data access and auth, test those directly and don't give credit for frontend polish alone.
Frequently Asked Questions
Is a Next.js developer the same as a React developer?
No. Next.js needs React skills plus server-side skills: data access, caching, auth, and deployment. For React-only work, see how to hire a senior React developer.
Should we use the App Router or the Pages Router?
For new apps, the Next.js team has recommended the App Router since 13.4. Existing Pages Router apps can migrate gradually, and a good hire will plan that in stages.
Does hosting on Vercel remove security risk?
It removed exposure to that particular middleware bug, according to Vercel's postmortem. It doesn't remove the need for authorization checks in your own code.
The Bottom Line
Hire Next.js developers who treat the framework as a backend: careful with the client boundary, clear on caching, and strict about where auth lives. React skill alone doesn't cover that. For senior engineers who have shipped production Next.js, see senior Next.js developers in LATAM or see available engineers. Early-stage teams should also read security for early-stage startups.
Roberto Espinoza is CEO of Ruzora, which helps US startups hire pre-vetted senior LATAM engineers, with a vetted shortlist in 72 hours. See available engineers.
