Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/next@10.2.4-canary.6
Typenpm
Namespace
Namenext
Version10.2.4-canary.6
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version15.5.18
Latest_non_vulnerable_version16.2.6
Affected_by_vulnerabilities
0
url VCID-29qk-jgck-2kb2
vulnerability_id VCID-29qk-jgck-2kb2
summary 
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-59471.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-59471.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-59471
reference_id
reference_type
scores
0
value 0.00041
scoring_system epss
scoring_elements 0.13005
published_at 2026-06-14T12:55:00Z
1
value 0.00041
scoring_system epss
scoring_elements 0.13027
published_at 2026-06-13T12:55:00Z
2
value 0.00041
scoring_system epss
scoring_elements 0.12923
published_at 2026-06-11T12:55:00Z
3
value 0.00041
scoring_system epss
scoring_elements 0.13017
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-59471
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
4
reference_url https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
5
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.10
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.10
6
reference_url https://github.com/vercel/next.js/releases/tag/v16.1.5
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.1.5
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2433094
reference_id 2433094
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2433094
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-59471
reference_id CVE-2025-59471
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-59471
9
reference_url https://github.com/advisories/GHSA-9g9p-9gw9-jx7f
reference_id GHSA-9g9p-9gw9-jx7f
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9g9p-9gw9-jx7f
10
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
reference_id GHSA-9g9p-9gw9-jx7f
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-27T14:54:47Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
fixed_packages
0
url pkg:npm/next@15.5.10
purl pkg:npm/next@15.5.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-bjvd-79eg-17f3
8
vulnerability VCID-gh18-cr6c-47hm
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-uqrk-gg9y-5bfz
11
vulnerability VCID-w4pk-pmxb-c7fr
12
vulnerability VCID-wgv6-ermy-yycy
13
vulnerability VCID-xzrf-tsxp-hqeg
14
vulnerability VCID-yddv-cunp-yyd7
15
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.10
1
url pkg:npm/next@16.1.5
purl pkg:npm/next@16.1.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-51r9-nmc2-tyc7
3
vulnerability VCID-5ehn-67ys-73h1
4
vulnerability VCID-6r5c-d48p-9qa4
5
vulnerability VCID-93c9-up9w-5fdv
6
vulnerability VCID-9r3b-phvp-xfck
7
vulnerability VCID-b2hu-vcgt-7ydr
8
vulnerability VCID-bjvd-79eg-17f3
9
vulnerability VCID-chsk-ka34-yqaf
10
vulnerability VCID-gh18-cr6c-47hm
11
vulnerability VCID-haxf-nay6-v3hg
12
vulnerability VCID-qptg-e7c6-puhs
13
vulnerability VCID-uqrk-gg9y-5bfz
14
vulnerability VCID-w4pk-pmxb-c7fr
15
vulnerability VCID-wgv6-ermy-yycy
16
vulnerability VCID-xzrf-tsxp-hqeg
17
vulnerability VCID-yddv-cunp-yyd7
18
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.5
aliases CVE-2025-59471, GHSA-9g9p-9gw9-jx7f
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-29qk-jgck-2kb2
1
url VCID-3614-49nb-r7em
vulnerability_id VCID-3614-49nb-r7em
summary Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47831.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47831.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-47831
reference_id
reference_type
scores
0
value 0.01306
scoring_system epss
scoring_elements 0.80195
published_at 2026-06-11T12:55:00Z
1
value 0.01306
scoring_system epss
scoring_elements 0.80264
published_at 2026-06-14T12:55:00Z
2
value 0.01306
scoring_system epss
scoring_elements 0.80256
published_at 2026-06-12T12:55:00Z
3
value 0.01306
scoring_system epss
scoring_elements 0.80273
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-47831
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2318607
reference_id 2318607
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2318607
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-47831
reference_id CVE-2024-47831
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-47831
5
reference_url https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
reference_id d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-15T14:51:58Z/
url https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
6
reference_url https://github.com/advisories/GHSA-g77x-44xx-532m
reference_id GHSA-g77x-44xx-532m
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g77x-44xx-532m
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
reference_id GHSA-g77x-44xx-532m
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-15T14:51:58Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
fixed_packages
0
url pkg:npm/next@14.2.7
purl pkg:npm/next@14.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-bwnq-891k-ykh7
8
vulnerability VCID-c9sc-ajq2-pyda
9
vulnerability VCID-gm62-hv3y-v7b8
10
vulnerability VCID-haxf-nay6-v3hg
11
vulnerability VCID-jgpv-ueke-37gf
12
vulnerability VCID-mv21-m5nh-vygs
13
vulnerability VCID-p7a7-ehjr-xqf3
14
vulnerability VCID-pzbj-fkbg-nkdw
15
vulnerability VCID-s5uv-nxf7-rkbj
16
vulnerability VCID-t6n1-e9kc-hqgx
17
vulnerability VCID-uqrk-gg9y-5bfz
18
vulnerability VCID-wdsq-y8uf-2feh
19
vulnerability VCID-wgv6-ermy-yycy
20
vulnerability VCID-xz2s-8drg-8bam
21
vulnerability VCID-xzrf-tsxp-hqeg
22
vulnerability VCID-yddv-cunp-yyd7
23
vulnerability VCID-zrny-u44x-3fh1
24
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.7
aliases CVE-2024-47831, GHSA-g77x-44xx-532m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3614-49nb-r7em
2
url VCID-93c9-up9w-5fdv
vulnerability_id VCID-93c9-up9w-5fdv
summary Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44577.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44577.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44577
reference_id
reference_type
scores
0
value 0.00018
scoring_system epss
scoring_elements 0.05048
published_at 2026-06-13T12:55:00Z
1
value 0.00018
scoring_system epss
scoring_elements 0.05058
published_at 2026-06-11T12:55:00Z
2
value 0.00018
scoring_system epss
scoring_elements 0.05061
published_at 2026-06-12T12:55:00Z
3
value 0.0002
scoring_system epss
scoring_elements 0.05727
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44577
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44577
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44577
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477194
reference_id 2477194
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477194
7
reference_url https://github.com/advisories/GHSA-h64f-5h5j-jqjh
reference_id GHSA-h64f-5h5j-jqjh
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h64f-5h5j-jqjh
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
reference_id GHSA-h64f-5h5j-jqjh
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-14T18:33:40Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
fixed_packages
0
url pkg:npm/next@15.5.16
purl pkg:npm/next@15.5.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.16
1
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44577, GHSA-h64f-5h5j-jqjh
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-93c9-up9w-5fdv
3
url VCID-bjvd-79eg-17f3
vulnerability_id VCID-bjvd-79eg-17f3
summary Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at the edge/proxy, and/or enforce authentication/authorization on backend routes.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29057.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29057.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-29057
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09488
published_at 2026-06-13T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.09477
published_at 2026-06-14T12:55:00Z
2
value 0.00031
scoring_system epss
scoring_elements 0.09495
published_at 2026-06-12T12:55:00Z
3
value 0.00031
scoring_system epss
scoring_elements 0.0944
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-29057
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-29057
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-29057
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2448515
reference_id 2448515
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2448515
5
reference_url https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
reference_id dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:47:14Z/
url https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
6
reference_url https://github.com/advisories/GHSA-ggv3-7p47-pfv8
reference_id GHSA-ggv3-7p47-pfv8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ggv3-7p47-pfv8
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
reference_id GHSA-ggv3-7p47-pfv8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:47:14Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
8
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.13
reference_id v15.5.13
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:47:14Z/
url https://github.com/vercel/next.js/releases/tag/v15.5.13
9
reference_url https://github.com/vercel/next.js/releases/tag/v16.1.7
reference_id v16.1.7
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:47:14Z/
url https://github.com/vercel/next.js/releases/tag/v16.1.7
fixed_packages
0
url pkg:npm/next@15.5.13
purl pkg:npm/next@15.5.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-gh18-cr6c-47hm
8
vulnerability VCID-haxf-nay6-v3hg
9
vulnerability VCID-uqrk-gg9y-5bfz
10
vulnerability VCID-w4pk-pmxb-c7fr
11
vulnerability VCID-wgv6-ermy-yycy
12
vulnerability VCID-xzrf-tsxp-hqeg
13
vulnerability VCID-yddv-cunp-yyd7
14
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.13
1
url pkg:npm/next@16.1.7
purl pkg:npm/next@16.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-gh18-cr6c-47hm
8
vulnerability VCID-haxf-nay6-v3hg
9
vulnerability VCID-w4pk-pmxb-c7fr
10
vulnerability VCID-wgv6-ermy-yycy
11
vulnerability VCID-xzrf-tsxp-hqeg
12
vulnerability VCID-yddv-cunp-yyd7
13
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.7
aliases CVE-2026-29057, GHSA-ggv3-7p47-pfv8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bjvd-79eg-17f3
4
url VCID-c68h-67ne-kkck
vulnerability_id VCID-c68h-67ne-kkck
summary Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-23646
reference_id
reference_type
scores
0
value 0.01381
scoring_system epss
scoring_elements 0.80756
published_at 2026-06-12T12:55:00Z
1
value 0.01381
scoring_system epss
scoring_elements 0.80696
published_at 2026-06-11T12:55:00Z
2
value 0.01381
scoring_system epss
scoring_elements 0.80757
published_at 2026-06-14T12:55:00Z
3
value 0.01381
scoring_system epss
scoring_elements 0.80767
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-23646
1
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
2
reference_url https://github.com/vercel/next.js/pull/34075
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/pull/34075
3
reference_url https://github.com/vercel/next.js/releases/tag/v12.1.0
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v12.1.0
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-23646
reference_id CVE-2022-23646
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-23646
5
reference_url https://github.com/advisories/GHSA-fmvm-x8mv-47mj
reference_id GHSA-fmvm-x8mv-47mj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fmvm-x8mv-47mj
6
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj
reference_id GHSA-fmvm-x8mv-47mj
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj
fixed_packages
0
url pkg:npm/next@12.1.0
purl pkg:npm/next@12.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-3614-49nb-r7em
2
vulnerability VCID-93c9-up9w-5fdv
3
vulnerability VCID-bjvd-79eg-17f3
4
vulnerability VCID-k79u-6118-zyag
5
vulnerability VCID-p7a7-ehjr-xqf3
6
vulnerability VCID-pzbj-fkbg-nkdw
7
vulnerability VCID-s5uv-nxf7-rkbj
8
vulnerability VCID-t6n1-e9kc-hqgx
9
vulnerability VCID-uqrk-gg9y-5bfz
10
vulnerability VCID-wdsq-y8uf-2feh
11
vulnerability VCID-xz2s-8drg-8bam
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@12.1.0
aliases CVE-2022-23646, GHSA-fmvm-x8mv-47mj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c68h-67ne-kkck
5
url VCID-k79u-6118-zyag
vulnerability_id VCID-k79u-6118-zyag
summary Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-46298
reference_id
reference_type
scores
0
value 0.00373
scoring_system epss
scoring_elements 0.59532
published_at 2026-06-12T12:55:00Z
1
value 0.00373
scoring_system epss
scoring_elements 0.59422
published_at 2026-06-11T12:55:00Z
2
value 0.00373
scoring_system epss
scoring_elements 0.59531
published_at 2026-06-14T12:55:00Z
3
value 0.00373
scoring_system epss
scoring_elements 0.59543
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-46298
1
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
2
reference_url https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46298
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-46298
4
reference_url https://github.com/vercel/next.js/issues/45301
reference_id 45301
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/
url https://github.com/vercel/next.js/issues/45301
5
reference_url https://github.com/vercel/next.js/pull/54732
reference_id 54732
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/
url https://github.com/vercel/next.js/pull/54732
6
reference_url https://github.com/advisories/GHSA-c59h-r6p8-q9wc
reference_id GHSA-c59h-r6p8-q9wc
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c59h-r6p8-q9wc
7
reference_url https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
reference_id v13.4.20-canary.12...v13.4.20-canary.13
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-12T17:50:22Z/
url https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
fixed_packages
0
url pkg:npm/next@13.4.20-canary.0
purl pkg:npm/next@13.4.20-canary.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-3614-49nb-r7em
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-7qxb-73at-5bet
5
vulnerability VCID-93c9-up9w-5fdv
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-bjvd-79eg-17f3
8
vulnerability VCID-c9sc-ajq2-pyda
9
vulnerability VCID-gm62-hv3y-v7b8
10
vulnerability VCID-haxf-nay6-v3hg
11
vulnerability VCID-jgpv-ueke-37gf
12
vulnerability VCID-k79u-6118-zyag
13
vulnerability VCID-mv21-m5nh-vygs
14
vulnerability VCID-p7a7-ehjr-xqf3
15
vulnerability VCID-pzbj-fkbg-nkdw
16
vulnerability VCID-qmqq-zdeg-vyh5
17
vulnerability VCID-qyq6-dq1h-s7en
18
vulnerability VCID-s5uv-nxf7-rkbj
19
vulnerability VCID-t6n1-e9kc-hqgx
20
vulnerability VCID-uqrk-gg9y-5bfz
21
vulnerability VCID-wdsq-y8uf-2feh
22
vulnerability VCID-wgv6-ermy-yycy
23
vulnerability VCID-xz2s-8drg-8bam
24
vulnerability VCID-xzrf-tsxp-hqeg
25
vulnerability VCID-yddv-cunp-yyd7
26
vulnerability VCID-zrny-u44x-3fh1
27
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@13.4.20-canary.0
1
url pkg:npm/next@13.4.20-canary.13
purl pkg:npm/next@13.4.20-canary.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-3614-49nb-r7em
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-7qxb-73at-5bet
5
vulnerability VCID-93c9-up9w-5fdv
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-bjvd-79eg-17f3
8
vulnerability VCID-c9sc-ajq2-pyda
9
vulnerability VCID-gm62-hv3y-v7b8
10
vulnerability VCID-haxf-nay6-v3hg
11
vulnerability VCID-jgpv-ueke-37gf
12
vulnerability VCID-k79u-6118-zyag
13
vulnerability VCID-mv21-m5nh-vygs
14
vulnerability VCID-p7a7-ehjr-xqf3
15
vulnerability VCID-pzbj-fkbg-nkdw
16
vulnerability VCID-qmqq-zdeg-vyh5
17
vulnerability VCID-qyq6-dq1h-s7en
18
vulnerability VCID-s5uv-nxf7-rkbj
19
vulnerability VCID-t6n1-e9kc-hqgx
20
vulnerability VCID-uqrk-gg9y-5bfz
21
vulnerability VCID-wdsq-y8uf-2feh
22
vulnerability VCID-wgv6-ermy-yycy
23
vulnerability VCID-xz2s-8drg-8bam
24
vulnerability VCID-xzrf-tsxp-hqeg
25
vulnerability VCID-yddv-cunp-yyd7
26
vulnerability VCID-zrny-u44x-3fh1
27
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@13.4.20-canary.13
2
url pkg:npm/next@13.5.0
purl pkg:npm/next@13.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-3614-49nb-r7em
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-jgpv-ueke-37gf
11
vulnerability VCID-mv21-m5nh-vygs
12
vulnerability VCID-p7a7-ehjr-xqf3
13
vulnerability VCID-pzbj-fkbg-nkdw
14
vulnerability VCID-qmqq-zdeg-vyh5
15
vulnerability VCID-qyq6-dq1h-s7en
16
vulnerability VCID-s5uv-nxf7-rkbj
17
vulnerability VCID-t6n1-e9kc-hqgx
18
vulnerability VCID-uqrk-gg9y-5bfz
19
vulnerability VCID-wdsq-y8uf-2feh
20
vulnerability VCID-wgv6-ermy-yycy
21
vulnerability VCID-xz2s-8drg-8bam
22
vulnerability VCID-xzrf-tsxp-hqeg
23
vulnerability VCID-yddv-cunp-yyd7
24
vulnerability VCID-zrny-u44x-3fh1
25
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@13.5.0
aliases CVE-2023-46298, GHSA-c59h-r6p8-q9wc
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k79u-6118-zyag
6
url VCID-p7a7-ehjr-xqf3
vulnerability_id VCID-p7a7-ehjr-xqf3
summary Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57752.json
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57752.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-57752
reference_id
reference_type
scores
0
value 0.00144
scoring_system epss
scoring_elements 0.34646
published_at 2026-06-14T12:55:00Z
1
value 0.00144
scoring_system epss
scoring_elements 0.34643
published_at 2026-06-12T12:55:00Z
2
value 0.00144
scoring_system epss
scoring_elements 0.34466
published_at 2026-06-11T12:55:00Z
3
value 0.00144
scoring_system epss
scoring_elements 0.34667
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-57752
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-57752
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-57752
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2392060
reference_id 2392060
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2392060
5
reference_url https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
reference_id 6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/
url https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
6
reference_url https://github.com/vercel/next.js/pull/82114
reference_id 82114
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/
url https://github.com/vercel/next.js/pull/82114
7
reference_url https://vercel.com/changelog/cve-2025-57752
reference_id cve-2025-57752
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/
url https://vercel.com/changelog/cve-2025-57752
8
reference_url https://github.com/advisories/GHSA-g5qg-72qw-gw5v
reference_id GHSA-g5qg-72qw-gw5v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g5qg-72qw-gw5v
9
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
reference_id GHSA-g5qg-72qw-gw5v
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:23:30Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
fixed_packages
0
url pkg:npm/next@14.2.31
purl pkg:npm/next@14.2.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-t6n1-e9kc-hqgx
11
vulnerability VCID-uqrk-gg9y-5bfz
12
vulnerability VCID-wgv6-ermy-yycy
13
vulnerability VCID-xzrf-tsxp-hqeg
14
vulnerability VCID-yddv-cunp-yyd7
15
vulnerability VCID-zrny-u44x-3fh1
16
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31
1
url pkg:npm/next@15.4.5
purl pkg:npm/next@15.4.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2rsy-25vf-cufu
2
vulnerability VCID-2wxy-d9mx-u7du
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-51mc-n64v-nugj
5
vulnerability VCID-5ehn-67ys-73h1
6
vulnerability VCID-6r5c-d48p-9qa4
7
vulnerability VCID-93c9-up9w-5fdv
8
vulnerability VCID-9r3b-phvp-xfck
9
vulnerability VCID-b2hu-vcgt-7ydr
10
vulnerability VCID-bjvd-79eg-17f3
11
vulnerability VCID-c9sc-ajq2-pyda
12
vulnerability VCID-gh18-cr6c-47hm
13
vulnerability VCID-gm62-hv3y-v7b8
14
vulnerability VCID-haxf-nay6-v3hg
15
vulnerability VCID-t6n1-e9kc-hqgx
16
vulnerability VCID-uqrk-gg9y-5bfz
17
vulnerability VCID-w4pk-pmxb-c7fr
18
vulnerability VCID-wgv6-ermy-yycy
19
vulnerability VCID-xzrf-tsxp-hqeg
20
vulnerability VCID-yddv-cunp-yyd7
21
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5
aliases CVE-2025-57752, GHSA-g5qg-72qw-gw5v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p7a7-ehjr-xqf3
7
url VCID-pzbj-fkbg-nkdw
vulnerability_id VCID-pzbj-fkbg-nkdw
summary Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-51479.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-51479.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-51479
reference_id
reference_type
scores
0
value 0.78509
scoring_system epss
scoring_elements 0.99065
published_at 2026-06-12T12:55:00Z
1
value 0.78509
scoring_system epss
scoring_elements 0.99066
published_at 2026-06-14T12:55:00Z
2
value 0.78509
scoring_system epss
scoring_elements 0.99061
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-51479
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-51479
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-51479
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2332884
reference_id 2332884
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2332884
6
reference_url https://github.com/advisories/GHSA-7gfc-8cq8-jh5f
reference_id GHSA-7gfc-8cq8-jh5f
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7gfc-8cq8-jh5f
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
reference_id GHSA-7gfc-8cq8-jh5f
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T20:36:20Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
8
reference_url https://access.redhat.com/errata/RHSA-2025:3807
reference_id RHSA-2025:3807
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:3807
9
reference_url https://github.com/vercel/next.js/releases/tag/v14.2.15
reference_id v14.2.15
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T20:36:20Z/
url https://github.com/vercel/next.js/releases/tag/v14.2.15
fixed_packages
0
url pkg:npm/next@14.2.15
purl pkg:npm/next@14.2.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-jgpv-ueke-37gf
11
vulnerability VCID-mv21-m5nh-vygs
12
vulnerability VCID-p7a7-ehjr-xqf3
13
vulnerability VCID-s5uv-nxf7-rkbj
14
vulnerability VCID-t6n1-e9kc-hqgx
15
vulnerability VCID-uqrk-gg9y-5bfz
16
vulnerability VCID-wdsq-y8uf-2feh
17
vulnerability VCID-wgv6-ermy-yycy
18
vulnerability VCID-xz2s-8drg-8bam
19
vulnerability VCID-xzrf-tsxp-hqeg
20
vulnerability VCID-yddv-cunp-yyd7
21
vulnerability VCID-zrny-u44x-3fh1
22
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.15
aliases CVE-2024-51479, GHSA-7gfc-8cq8-jh5f
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pzbj-fkbg-nkdw
8
url VCID-t6n1-e9kc-hqgx
vulnerability_id VCID-t6n1-e9kc-hqgx
summary Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-57822
reference_id
reference_type
scores
0
value 0.07815
scoring_system epss
scoring_elements 0.92201
published_at 2026-06-14T12:55:00Z
1
value 0.07815
scoring_system epss
scoring_elements 0.92168
published_at 2026-06-11T12:55:00Z
2
value 0.07815
scoring_system epss
scoring_elements 0.92195
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-57822
1
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-57822
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-57822
3
reference_url https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
reference_id 9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/
url https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
4
reference_url https://vercel.com/changelog/cve-2025-57822
reference_id cve-2025-57822
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/
url https://vercel.com/changelog/cve-2025-57822
5
reference_url https://github.com/advisories/GHSA-4342-x723-ch2f
reference_id GHSA-4342-x723-ch2f
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4342-x723-ch2f
6
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
reference_id GHSA-4342-x723-ch2f
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T17:26:15Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
fixed_packages
0
url pkg:npm/next@14.2.32
purl pkg:npm/next@14.2.32
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-uqrk-gg9y-5bfz
11
vulnerability VCID-wgv6-ermy-yycy
12
vulnerability VCID-xzrf-tsxp-hqeg
13
vulnerability VCID-yddv-cunp-yyd7
14
vulnerability VCID-zrny-u44x-3fh1
15
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.32
1
url pkg:npm/next@15.4.7
purl pkg:npm/next@15.4.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2rsy-25vf-cufu
2
vulnerability VCID-2wxy-d9mx-u7du
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-51mc-n64v-nugj
5
vulnerability VCID-5ehn-67ys-73h1
6
vulnerability VCID-6r5c-d48p-9qa4
7
vulnerability VCID-93c9-up9w-5fdv
8
vulnerability VCID-9r3b-phvp-xfck
9
vulnerability VCID-b2hu-vcgt-7ydr
10
vulnerability VCID-bjvd-79eg-17f3
11
vulnerability VCID-c9sc-ajq2-pyda
12
vulnerability VCID-gh18-cr6c-47hm
13
vulnerability VCID-gm62-hv3y-v7b8
14
vulnerability VCID-haxf-nay6-v3hg
15
vulnerability VCID-uqrk-gg9y-5bfz
16
vulnerability VCID-w4pk-pmxb-c7fr
17
vulnerability VCID-wgv6-ermy-yycy
18
vulnerability VCID-xzrf-tsxp-hqeg
19
vulnerability VCID-yddv-cunp-yyd7
20
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.7
aliases CVE-2025-57822, GHSA-4342-x723-ch2f
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t6n1-e9kc-hqgx
9
url VCID-uqrk-gg9y-5bfz
vulnerability_id VCID-uqrk-gg9y-5bfz
summary Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27980.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27980.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-27980
reference_id
reference_type
scores
0
value 0.00023
scoring_system epss
scoring_elements 0.06888
published_at 2026-06-12T12:55:00Z
1
value 0.00023
scoring_system epss
scoring_elements 0.06862
published_at 2026-06-14T12:55:00Z
2
value 0.00023
scoring_system epss
scoring_elements 0.06876
published_at 2026-06-13T12:55:00Z
3
value 0.00023
scoring_system epss
scoring_elements 0.06863
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-27980
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27980
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-27980
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2448509
reference_id 2448509
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2448509
5
reference_url https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd
reference_id 39eb8e0ac498b48855a0430fbf4c22276a73b4bd
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T19:50:06Z/
url https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd
6
reference_url https://github.com/advisories/GHSA-3x4c-7xq6-9pq8
reference_id GHSA-3x4c-7xq6-9pq8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3x4c-7xq6-9pq8
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8
reference_id GHSA-3x4c-7xq6-9pq8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T19:50:06Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8
8
reference_url https://access.redhat.com/errata/RHSA-2026:13571
reference_id RHSA-2026:13571
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:13571
9
reference_url https://github.com/vercel/next.js/releases/tag/v16.1.7
reference_id v16.1.7
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T19:50:06Z/
url https://github.com/vercel/next.js/releases/tag/v16.1.7
fixed_packages
0
url pkg:npm/next@15.5.14
purl pkg:npm/next@15.5.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-gh18-cr6c-47hm
8
vulnerability VCID-haxf-nay6-v3hg
9
vulnerability VCID-w4pk-pmxb-c7fr
10
vulnerability VCID-wgv6-ermy-yycy
11
vulnerability VCID-xzrf-tsxp-hqeg
12
vulnerability VCID-yddv-cunp-yyd7
13
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.14
1
url pkg:npm/next@15.6.0-canary.0
purl pkg:npm/next@15.6.0-canary.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-51mc-n64v-nugj
2
vulnerability VCID-c9sc-ajq2-pyda
3
vulnerability VCID-gm62-hv3y-v7b8
4
vulnerability VCID-v7dq-7t8n-j7b5
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.6.0-canary.0
2
url pkg:npm/next@16.1.7
purl pkg:npm/next@16.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-gh18-cr6c-47hm
8
vulnerability VCID-haxf-nay6-v3hg
9
vulnerability VCID-w4pk-pmxb-c7fr
10
vulnerability VCID-wgv6-ermy-yycy
11
vulnerability VCID-xzrf-tsxp-hqeg
12
vulnerability VCID-yddv-cunp-yyd7
13
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.7
aliases CVE-2026-27980, GHSA-3x4c-7xq6-9pq8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uqrk-gg9y-5bfz
10
url VCID-vb3c-u8td-7ye4
vulnerability_id VCID-vb3c-u8td-7ye4
summary
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-39178
reference_id
reference_type
scores
0
value 0.007
scoring_system epss
scoring_elements 0.72485
published_at 2026-06-11T12:55:00Z
1
value 0.007
scoring_system epss
scoring_elements 0.72563
published_at 2026-06-12T12:55:00Z
2
value 0.007
scoring_system epss
scoring_elements 0.72577
published_at 2026-06-13T12:55:00Z
3
value 0.007
scoring_system epss
scoring_elements 0.72573
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-39178
1
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
2
reference_url https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
3
reference_url https://github.com/vercel/next.js/pull/28620
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/pull/28620
4
reference_url https://github.com/vercel/next.js/releases/tag/v11.1.1
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v11.1.1
5
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-39178
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-39178
7
reference_url https://github.com/advisories/GHSA-9gr3-7897-pp7m
reference_id GHSA-9gr3-7897-pp7m
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9gr3-7897-pp7m
fixed_packages
0
url pkg:npm/next@11.1.1
purl pkg:npm/next@11.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-3614-49nb-r7em
2
vulnerability VCID-93c9-up9w-5fdv
3
vulnerability VCID-bjvd-79eg-17f3
4
vulnerability VCID-c68h-67ne-kkck
5
vulnerability VCID-k79u-6118-zyag
6
vulnerability VCID-p7a7-ehjr-xqf3
7
vulnerability VCID-pzbj-fkbg-nkdw
8
vulnerability VCID-s9pm-xyj1-yydc
9
vulnerability VCID-t6n1-e9kc-hqgx
10
vulnerability VCID-uqrk-gg9y-5bfz
11
vulnerability VCID-w11n-v968-juaz
12
vulnerability VCID-wdsq-y8uf-2feh
13
vulnerability VCID-xz2s-8drg-8bam
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@11.1.1
aliases CVE-2021-39178, GHSA-9gr3-7897-pp7m
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vb3c-u8td-7ye4
11
url VCID-wdsq-y8uf-2feh
vulnerability_id VCID-wdsq-y8uf-2feh
summary Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55173.json
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55173.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-55173
reference_id
reference_type
scores
0
value 0.00687
scoring_system epss
scoring_elements 0.72299
published_at 2026-06-14T12:55:00Z
1
value 0.00687
scoring_system epss
scoring_elements 0.72292
published_at 2026-06-12T12:55:00Z
2
value 0.00687
scoring_system epss
scoring_elements 0.72305
published_at 2026-06-13T12:55:00Z
3
value 0.00687
scoring_system epss
scoring_elements 0.72209
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-55173
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-55173
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-55173
4
reference_url http://vercel.com/changelog/cve-2025-55173
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://vercel.com/changelog/cve-2025-55173
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2392059
reference_id 2392059
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2392059
6
reference_url https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
reference_id 6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/
url https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
7
reference_url https://vercel.com/changelog/cve-2025-55173
reference_id cve-2025-55173
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/
url https://vercel.com/changelog/cve-2025-55173
8
reference_url https://github.com/advisories/GHSA-xv57-4mr9-wg8v
reference_id GHSA-xv57-4mr9-wg8v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xv57-4mr9-wg8v
9
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
reference_id GHSA-xv57-4mr9-wg8v
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-02T19:22:48Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
fixed_packages
0
url pkg:npm/next@14.2.31
purl pkg:npm/next@14.2.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-t6n1-e9kc-hqgx
11
vulnerability VCID-uqrk-gg9y-5bfz
12
vulnerability VCID-wgv6-ermy-yycy
13
vulnerability VCID-xzrf-tsxp-hqeg
14
vulnerability VCID-yddv-cunp-yyd7
15
vulnerability VCID-zrny-u44x-3fh1
16
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31
1
url pkg:npm/next@15.4.5
purl pkg:npm/next@15.4.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2rsy-25vf-cufu
2
vulnerability VCID-2wxy-d9mx-u7du
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-51mc-n64v-nugj
5
vulnerability VCID-5ehn-67ys-73h1
6
vulnerability VCID-6r5c-d48p-9qa4
7
vulnerability VCID-93c9-up9w-5fdv
8
vulnerability VCID-9r3b-phvp-xfck
9
vulnerability VCID-b2hu-vcgt-7ydr
10
vulnerability VCID-bjvd-79eg-17f3
11
vulnerability VCID-c9sc-ajq2-pyda
12
vulnerability VCID-gh18-cr6c-47hm
13
vulnerability VCID-gm62-hv3y-v7b8
14
vulnerability VCID-haxf-nay6-v3hg
15
vulnerability VCID-t6n1-e9kc-hqgx
16
vulnerability VCID-uqrk-gg9y-5bfz
17
vulnerability VCID-w4pk-pmxb-c7fr
18
vulnerability VCID-wgv6-ermy-yycy
19
vulnerability VCID-xzrf-tsxp-hqeg
20
vulnerability VCID-yddv-cunp-yyd7
21
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5
aliases CVE-2025-55173, GHSA-xv57-4mr9-wg8v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wdsq-y8uf-2feh
12
url VCID-xz2s-8drg-8bam
vulnerability_id VCID-xz2s-8drg-8bam
summary Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-32421.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-32421.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-32421
reference_id
reference_type
scores
0
value 0.00752
scoring_system epss
scoring_elements 0.73722
published_at 2026-06-14T12:55:00Z
1
value 0.00752
scoring_system epss
scoring_elements 0.73706
published_at 2026-06-12T12:55:00Z
2
value 0.00752
scoring_system epss
scoring_elements 0.73631
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-32421
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-32421
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-32421
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2366366
reference_id 2366366
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2366366
5
reference_url https://vercel.com/changelog/cve-2025-32421
reference_id cve-2025-32421
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T15:40:39Z/
url https://vercel.com/changelog/cve-2025-32421
6
reference_url https://github.com/advisories/GHSA-qpjv-v59x-3qc4
reference_id GHSA-qpjv-v59x-3qc4
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qpjv-v59x-3qc4
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
reference_id GHSA-qpjv-v59x-3qc4
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T15:40:39Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
fixed_packages
0
url pkg:npm/next@14.2.24
purl pkg:npm/next@14.2.24
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2wxy-d9mx-u7du
2
vulnerability VCID-4kgz-73xy-xyb2
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-b2hu-vcgt-7ydr
6
vulnerability VCID-bjvd-79eg-17f3
7
vulnerability VCID-c9sc-ajq2-pyda
8
vulnerability VCID-gm62-hv3y-v7b8
9
vulnerability VCID-haxf-nay6-v3hg
10
vulnerability VCID-mv21-m5nh-vygs
11
vulnerability VCID-p7a7-ehjr-xqf3
12
vulnerability VCID-s5uv-nxf7-rkbj
13
vulnerability VCID-t6n1-e9kc-hqgx
14
vulnerability VCID-uqrk-gg9y-5bfz
15
vulnerability VCID-wdsq-y8uf-2feh
16
vulnerability VCID-wgv6-ermy-yycy
17
vulnerability VCID-xzrf-tsxp-hqeg
18
vulnerability VCID-yddv-cunp-yyd7
19
vulnerability VCID-zrny-u44x-3fh1
20
vulnerability VCID-zuh1-7568-nbg3
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.24
1
url pkg:npm/next@15.1.6
purl pkg:npm/next@15.1.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29qk-jgck-2kb2
1
vulnerability VCID-2rsy-25vf-cufu
2
vulnerability VCID-2wxy-d9mx-u7du
3
vulnerability VCID-4kgz-73xy-xyb2
4
vulnerability VCID-51mc-n64v-nugj
5
vulnerability VCID-5ehn-67ys-73h1
6
vulnerability VCID-6r5c-d48p-9qa4
7
vulnerability VCID-93c9-up9w-5fdv
8
vulnerability VCID-b2hu-vcgt-7ydr
9
vulnerability VCID-bjvd-79eg-17f3
10
vulnerability VCID-c9sc-ajq2-pyda
11
vulnerability VCID-gm62-hv3y-v7b8
12
vulnerability VCID-haxf-nay6-v3hg
13
vulnerability VCID-mv21-m5nh-vygs
14
vulnerability VCID-p7a7-ehjr-xqf3
15
vulnerability VCID-s5uv-nxf7-rkbj
16
vulnerability VCID-t6n1-e9kc-hqgx
17
vulnerability VCID-uqrk-gg9y-5bfz
18
vulnerability VCID-wdsq-y8uf-2feh
19
vulnerability VCID-wgv6-ermy-yycy
20
vulnerability VCID-xzrf-tsxp-hqeg
21
vulnerability VCID-yddv-cunp-yyd7
22
vulnerability VCID-zrny-u44x-3fh1
23
vulnerability VCID-zrw8-shww-mqe4
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.6
aliases CVE-2025-32421, GHSA-qpjv-v59x-3qc4
risk_score 1.6
exploitability 0.5
weighted_severity 3.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xz2s-8drg-8bam
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/next@10.2.4-canary.6