Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/142311?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/142311?format=api", "purl": "pkg:npm/next@0.9.9", "type": "npm", "namespace": "", "name": "next", "version": "0.9.9", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "15.5.14", "latest_non_vulnerable_version": "16.2.3", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8538?format=api", "vulnerability_id": "VCID-1q1j-qgqj-syhw", "summary": "Path Traversal\nNext has directory traversal under the `/_next` and `/static` request namespace, allowing attackers to obtain sensitive information.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16877", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.80763", "scoring_system": "epss", "scoring_elements": "0.99146", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.80763", "scoring_system": "epss", "scoring_elements": "0.99149", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.80763", "scoring_system": "epss", "scoring_elements": "0.99145", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99268", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99256", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99258", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.9926", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99264", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99265", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99266", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.83198", "scoring_system": "epss", "scoring_elements": "0.99267", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16877" }, { "reference_url": "https://github.com/vercel/next.js/commit/02fe7cf63f6265d73bdaf8bc50a4f2fb539dcd00", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/commit/02fe7cf63f6265d73bdaf8bc50a4f2fb539dcd00" }, { "reference_url": "https://github.com/zeit/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zeit/next.js" }, { "reference_url": "https://github.com/zeit/next.js/releases/tag/2.4.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zeit/next.js/releases/tag/2.4.1" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16877", "reference_id": "CVE-2017-16877", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:P/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16877" }, { "reference_url": "https://github.com/advisories/GHSA-3f5c-4qxj-vmpf", "reference_id": "GHSA-3f5c-4qxj-vmpf", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3f5c-4qxj-vmpf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25544?format=api", "purl": "pkg:npm/next@2.4.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-321e-gyty-sfdp" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-kz7q-razc-pyf2" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-x7z9-16hk-fqbs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@2.4.1" } ], "aliases": [ "CVE-2017-16877", "GHSA-3f5c-4qxj-vmpf" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1q1j-qgqj-syhw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11028?format=api", "vulnerability_id": "VCID-4j11-d1fm-cbe4", "summary": "URL Redirection to Untrusted Site (Open Redirect)\nNext.In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-37699", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62492", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62572", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62589", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62583", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62564", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62576", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62557", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62542", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62434", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.6249", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0043", "scoring_system": "epss", "scoring_elements": "0.62524", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-37699" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/releases/tag/v11.1.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/releases/tag/v11.1.0" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37699", "reference_id": "CVE-2021-37699", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37699" }, { "reference_url": "https://github.com/advisories/GHSA-vxf5-wxwp-m7g9", "reference_id": "GHSA-vxf5-wxwp-m7g9", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vxf5-wxwp-m7g9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/258126?format=api", "purl": "pkg:npm/next@10.2.1-canary.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-6crq-f4sg-v7cf" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-n7z1-rgg3-zbbb" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@10.2.1-canary.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/38129?format=api", "purl": "pkg:npm/next@10.2.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-6crq-f4sg-v7cf" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-n7z1-rgg3-zbbb" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@10.2.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/42090?format=api", "purl": "pkg:npm/next@11.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4j11-d1fm-cbe4" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-6crq-f4sg-v7cf" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-n7z1-rgg3-zbbb" }, { "vulnerability": "VCID-pqzm-ped7-vkff" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@11.1.0" } ], "aliases": [ "CVE-2021-37699", "GHSA-vxf5-wxwp-m7g9" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4j11-d1fm-cbe4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27932?format=api", "vulnerability_id": "VCID-54qu-9bx2-9ka8", "summary": "Next.js Improper Middleware Redirect Handling Leads to SSRF\nA vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.\n\nAll users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57822", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90314", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.9034", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90333", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90319", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90302", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90357", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90341", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.05626", "scoring_system": "epss", "scoring_elements": "0.90348", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.06479", "scoring_system": "epss", "scoring_elements": "0.91127", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.06479", "scoring_system": "epss", "scoring_elements": "0.91113", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57822" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/" } ], "url": "https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57822", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57822" }, { "reference_url": "https://vercel.com/changelog/cve-2025-57822", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/" } ], "url": "https://vercel.com/changelog/cve-2025-57822" }, { "reference_url": "https://github.com/advisories/GHSA-4342-x723-ch2f", "reference_id": "GHSA-4342-x723-ch2f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4342-x723-ch2f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69791?format=api", "purl": "pkg:npm/next@14.2.32", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.32" }, { "url": "http://public2.vulnerablecode.io/api/packages/69792?format=api", "purl": "pkg:npm/next@15.4.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-2tah-y5sg-hugp" }, { "vulnerability": "VCID-3m4d-v2y1-5ua4" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-pqwe-3ukm-dkh4" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.7" } ], "aliases": [ "CVE-2025-57822", "GHSA-4342-x723-ch2f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-54qu-9bx2-9ka8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/33079?format=api", "vulnerability_id": "VCID-kz7q-razc-pyf2", "summary": "Remote Code Execution in next\nVersions of `next` prior to 5.1.0 are vulnerable to Remote Code Execution. The `/path:` route fails to properly sanitize input and passes it to a `require()` call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 package `next` npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.\n\n## Recommendation\n\nUpgrade to version 5.1.0.", "references": [ { "reference_url": "https://github.com/masasron/vulnerability-research/tree/master/CVE-2018-6184/LFI", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/masasron/vulnerability-research/tree/master/CVE-2018-6184/LFI" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://www.npmjs.com/advisories/1538", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/advisories/1538" }, { "reference_url": "https://github.com/advisories/GHSA-5vj8-3v2h-h38v", "reference_id": "GHSA-5vj8-3v2h-h38v", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5vj8-3v2h-h38v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72922?format=api", "purl": "pkg:npm/next@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-x7z9-16hk-fqbs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@5.1.0" } ], "aliases": [ "GHSA-5vj8-3v2h-h38v", "GMS-2020-750" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kz7q-razc-pyf2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11753?format=api", "vulnerability_id": "VCID-pqzm-ped7-vkff", "summary": "Improper Input Validation\nNext handling invalid or malformed URLs could lead to a server crash. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-43803", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84281", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84401", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84375", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84372", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84371", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84349", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84353", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.8436", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84342", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84337", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84315", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84314", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0218", "scoring_system": "epss", "scoring_elements": "0.84294", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-43803" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264" }, { "reference_url": "https://github.com/vercel/next.js/pull/32080", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/pull/32080" }, { "reference_url": "https://github.com/vercel/next.js/releases/tag/v11.1.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/releases/tag/v11.1.3" }, { "reference_url": "https://github.com/vercel/next.js/releases/v12.0.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/releases/v12.0.5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43803", "reference_id": "CVE-2021-43803", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43803" }, { "reference_url": "https://github.com/advisories/GHSA-25mp-g6fv-mqxx", "reference_id": "GHSA-25mp-g6fv-mqxx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-25mp-g6fv-mqxx" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx", "reference_id": "GHSA-25mp-g6fv-mqxx", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/42095?format=api", "purl": "pkg:npm/next@11.1.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-n7z1-rgg3-zbbb" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@11.1.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/42097?format=api", "purl": "pkg:npm/next@12.0.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-n7z1-rgg3-zbbb" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-tyjv-73n8-fybf" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@12.0.5" } ], "aliases": [ "CVE-2021-43803", "GHSA-25mp-g6fv-mqxx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pqzm-ped7-vkff" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28519?format=api", "vulnerability_id": "VCID-r4pw-m8mz-xbdq", "summary": "Next.js Affected by Cache Key Confusion for Image Optimization API Routes\nA vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.\n\nAll users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57752.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57752.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57752", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19327", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19434", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19421", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19413", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19452", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.1951", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19557", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19554", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19502", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19423", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.197", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19653", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57752" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/" } ], "url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd" }, { "reference_url": "https://github.com/vercel/next.js/pull/82114", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/" } ], "url": "https://github.com/vercel/next.js/pull/82114" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57752" }, { "reference_url": "https://vercel.com/changelog/cve-2025-57752", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/" } ], "url": "https://vercel.com/changelog/cve-2025-57752" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392060", "reference_id": "2392060", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392060" }, { "reference_url": "https://github.com/advisories/GHSA-g5qg-72qw-gw5v", "reference_id": "GHSA-g5qg-72qw-gw5v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g5qg-72qw-gw5v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69872?format=api", "purl": "pkg:npm/next@14.2.31", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31" }, { "url": "http://public2.vulnerablecode.io/api/packages/69873?format=api", "purl": "pkg:npm/next@15.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-2tah-y5sg-hugp" }, { "vulnerability": "VCID-3m4d-v2y1-5ua4" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-pqwe-3ukm-dkh4" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5" } ], "aliases": [ "CVE-2025-57752", "GHSA-g5qg-72qw-gw5v" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r4pw-m8mz-xbdq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19557?format=api", "vulnerability_id": "VCID-rx4e-7jj2-9udg", "summary": "Next.js missing cache-control header may lead to CDN caching empty reply\nNext.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-46298", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61797", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61749", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.6172", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61769", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61784", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61805", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61792", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61773", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61814", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61819", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61802", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.61719", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-46298" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648" }, { "reference_url": "https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/" } ], "url": "https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13" }, { "reference_url": "https://github.com/vercel/next.js/issues/45301", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/" } ], "url": "https://github.com/vercel/next.js/issues/45301" }, { "reference_url": "https://github.com/vercel/next.js/pull/54732", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/" } ], "url": "https://github.com/vercel/next.js/pull/54732" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46298", "reference_id": "CVE-2023-46298", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46298" }, { "reference_url": "https://github.com/advisories/GHSA-c59h-r6p8-q9wc", "reference_id": "GHSA-c59h-r6p8-q9wc", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-c59h-r6p8-q9wc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60714?format=api", "purl": "pkg:npm/next@13.4.20-canary.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-3szn-4nn4-3fek" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-gxry-99g5-9ubz" }, { "vulnerability": "VCID-hvgn-qbwr-tkbg" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ub68-nqch-bkdm" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xu9v-gnn9-bfhf" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@13.4.20-canary.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/71289?format=api", "purl": "pkg:npm/next@13.4.20-canary.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-3szn-4nn4-3fek" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-gxry-99g5-9ubz" }, { "vulnerability": "VCID-hvgn-qbwr-tkbg" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ub68-nqch-bkdm" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xu9v-gnn9-bfhf" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@13.4.20-canary.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/58044?format=api", "purl": "pkg:npm/next@13.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-3szn-4nn4-3fek" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-fwnm-krm1-6kh6" }, { "vulnerability": "VCID-gxry-99g5-9ubz" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ub68-nqch-bkdm" }, { "vulnerability": "VCID-ukfu-ane3-vfch" }, { "vulnerability": "VCID-vwym-qr5h-fue8" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xu9v-gnn9-bfhf" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@13.5.0" } ], "aliases": [ "CVE-2023-46298", "GHSA-c59h-r6p8-q9wc" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rx4e-7jj2-9udg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28594?format=api", "vulnerability_id": "VCID-sjdx-v2z6-3fcw", "summary": "Next.js Content Injection Vulnerability for Image Optimization\nA vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.\n\nAll users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55173.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55173.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55173", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.4147", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41577", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41652", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41678", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41631", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41677", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41668", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41654", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41645", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41595", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00206", "scoring_system": "epss", "scoring_elements": "0.42968", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55173" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/" } ], "url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55173", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55173" }, { "reference_url": "https://vercel.com/changelog/cve-2025-55173", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/" } ], "url": "https://vercel.com/changelog/cve-2025-55173" }, { "reference_url": "http://vercel.com/changelog/cve-2025-55173", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://vercel.com/changelog/cve-2025-55173" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392059", "reference_id": "2392059", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392059" }, { "reference_url": "https://github.com/advisories/GHSA-xv57-4mr9-wg8v", "reference_id": "GHSA-xv57-4mr9-wg8v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv57-4mr9-wg8v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69872?format=api", "purl": "pkg:npm/next@14.2.31", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31" }, { "url": "http://public2.vulnerablecode.io/api/packages/69873?format=api", "purl": "pkg:npm/next@15.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-2tah-y5sg-hugp" }, { "vulnerability": "VCID-3m4d-v2y1-5ua4" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-pqwe-3ukm-dkh4" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5" } ], "aliases": [ "CVE-2025-55173", "GHSA-xv57-4mr9-wg8v" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sjdx-v2z6-3fcw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30417?format=api", "vulnerability_id": "VCID-vwym-qr5h-fue8", "summary": "Next.js Race Condition to Cache Poisoning\n**Summary** \nWe received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML.\n\n[Learn more here](https://vercel.com/changelog/cve-2025-32421)\n\n**Credit** \nThank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-32421.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-32421.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-32421", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58153", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58151", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58171", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58146", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.582", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58204", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.5822", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58197", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58177", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58209", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58212", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0036", "scoring_system": "epss", "scoring_elements": "0.58187", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-32421" }, { "reference_url": "https://github.com/vercel/next.js", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/vercel/next.js" }, { "reference_url": "https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T15:40:39Z/" } ], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32421", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32421" }, { "reference_url": "https://vercel.com/changelog/cve-2025-32421", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T15:40:39Z/" } ], "url": "https://vercel.com/changelog/cve-2025-32421" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366366", "reference_id": "2366366", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366366" }, { "reference_url": "https://github.com/advisories/GHSA-qpjv-v59x-3qc4", "reference_id": "GHSA-qpjv-v59x-3qc4", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qpjv-v59x-3qc4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/71194?format=api", "purl": "pkg:npm/next@14.2.24", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-fpzm-tpp7-jbft" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ub68-nqch-bkdm" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.24" }, { "url": "http://public2.vulnerablecode.io/api/packages/71195?format=api", "purl": "pkg:npm/next@15.1.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1qzn-gxkv-wye3" }, { "vulnerability": "VCID-2tah-y5sg-hugp" }, { "vulnerability": "VCID-3m4d-v2y1-5ua4" }, { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-5kj1-stm6-8qgv" }, { "vulnerability": "VCID-dyak-ybr6-fyhy" }, { "vulnerability": "VCID-jst7-263v-1ydx" }, { "vulnerability": "VCID-pqwe-3ukm-dkh4" }, { "vulnerability": "VCID-qz2s-22e2-ufg9" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-ub68-nqch-bkdm" }, { "vulnerability": "VCID-w35n-bwuy-5kce" }, { "vulnerability": "VCID-xv6q-hbf8-b7b1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.6" } ], "aliases": [ "CVE-2025-32421", "GHSA-qpjv-v59x-3qc4" ], "risk_score": 1.6, "exploitability": "0.5", "weighted_severity": "3.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vwym-qr5h-fue8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/33425?format=api", "vulnerability_id": "VCID-x7z9-16hk-fqbs", "summary": "Directory Traversal in Next.js\n### Impact\n\n- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected\n- **Not affected**: Deployments using the `serverless` target\n- **Not affected**: Deployments using `next export`\n- **Affected**: Users of Next.js below 9.3.2\n\nWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.\n\n### Patches\n\nhttps://github.com/zeit/next.js/releases/tag/v9.3.2\n\n### References\n\nhttps://github.com/zeit/next.js/releases/tag/v9.3.2", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-5284", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99195", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99207", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99205", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99204", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99203", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99199", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.8195", "scoring_system": "epss", "scoring_elements": "0.99197", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.8321", "scoring_system": "epss", "scoring_elements": "0.9927", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.8321", "scoring_system": "epss", "scoring_elements": "0.99268", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-5284" }, { "reference_url": "https://github.com/zeit/next.js/releases/tag/v9.3.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2" }, { "reference_url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5284", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:P/I:N/A:N" }, { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5284" }, { "reference_url": "https://www.npmjs.com/advisories/1503", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/advisories/1503" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-fq77-7p7r-83rj", "reference_id": "GHSA-fq77-7p7r-83rj", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fq77-7p7r-83rj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73218?format=api", "purl": "pkg:npm/next@9.3.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-54qu-9bx2-9ka8" }, { "vulnerability": "VCID-r4pw-m8mz-xbdq" }, { "vulnerability": "VCID-rx4e-7jj2-9udg" }, { "vulnerability": "VCID-sjdx-v2z6-3fcw" }, { "vulnerability": "VCID-vwym-qr5h-fue8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@9.3.2" } ], "aliases": [ "CVE-2020-5284", "GHSA-fq77-7p7r-83rj" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x7z9-16hk-fqbs" } ], "fixing_vulnerabilities": [], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/next@0.9.9" }