The Next.js Turducken
Next.js is the turducken of web frameworks. Layer after layer of abstractions, each one hiding the browser-server boundary. Two weeks ago, that gave us a CVSS 10.0 vulnerability. The boundary isn't an inconvenience to abstract away. It's a security perimeter.