Information leaks (stack traces, X-Powered-By)
Two leaks that are individually low-severity, but that give an attacker clues to aim their next attempt instead of testing at random.
X-Powered-By header
Reveals the technology and sometimes the server version (X-Powered-By: Express). An attacker immediately knows which known vulnerabilities to look for instead of guessing the stack.
// Express
app.disable('x-powered-by');Next.js doesn't send it by default.
Visible stack traces
An unhandled error that displays its full trace in the HTML reveals the code structure, file paths, and library versions used — information an attacker uses to refine their approach.
Check that NODE_ENV=production is properly set in production (most frameworks, Next.js included, hide traces automatically in that mode) and set up a custom 500 error page that doesn't show the user any technical detail.
Why bother anyway
Individually, these leaks compromise nothing directly. But a security audit (yours or an attacker's) adds up the small clues: the exact stack, the version, the error structure — enough to turn a generic attack into a targeted one.
Check whether your site is affected by this vulnerability.
Scan my app