Critical security flaw in Next.js could spell big trouble for JavaScript users