Server version headers are suppressed

Server X-Powered-By: Next.js and Server: nginx/1.24.0 headers hand attackers a pre-filled target list: they know your exact framework and server version without running a single probe, and can immediately cross-reference known CVEs. This is reconnaissance that costs the attacker nothing and costs you nothing to prevent. CWE-200 (Exposure of Sensitive Information) and CWE-497 (Exposure of System Data to Unauthorized Control Sphere) both apply. OWASP A05 (Security Misconfiguration) lists version disclosure as a baseline misconfiguration. Suppressing these headers doesn't fix vulnerabilities, but it eliminates passive fingerprinting and forces attackers to do active work.

Set poweredByHeader: false in next.config.js to suppress the X-Powered-By header. On Vercel this is stripped by default, but the explicit config ensures it doesn't reappear if you self-host.

// next.config.js
const nextConfig = {
  poweredByHeader: false,
}
export default nextConfig

For Express: app.disable('x-powered-by') or helmet(), which disables it automatically. The Server header is usually controlled by your reverse proxy (nginx, Caddy) — set server_tokens off; in your nginx config to suppress the version number.