Unsafe file uploads in Next.js

Limit size before you buffer the whole file. Allow a short list of types you actually need (for example PNG, JPEG, WebP). Detect type from the bytes if you can, and still do not trust the extension alone.

Store a generated name (userId/random-id), never the raw filename. Serve user files from a different host when you can, or with Content-Disposition: attachment and X-Content-Type-Options: nosniff. Do not serve user SVG or HTML as an image preview on your origin.