| 0 |
| url |
VCID-29qk-jgck-2kb2 |
| vulnerability_id |
VCID-29qk-jgck-2kb2 |
| summary |
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.
Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@15.5.10 |
| purl |
pkg:npm/next@15.5.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.10 |
|
| 1 |
| url |
pkg:npm/next@16.1.5 |
| purl |
pkg:npm/next@16.1.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 13 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 14 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 15 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 16 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 17 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 18 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.5 |
|
|
| aliases |
CVE-2025-59471, GHSA-9g9p-9gw9-jx7f
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-29qk-jgck-2kb2 |
|
| 1 |
| url |
VCID-2wxy-d9mx-u7du |
| vulnerability_id |
VCID-2wxy-d9mx-u7du |
| summary |
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44573, GHSA-36qx-fr4f-26g5
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2wxy-d9mx-u7du |
|
| 2 |
| url |
VCID-3614-49nb-r7em |
| vulnerability_id |
VCID-3614-49nb-r7em |
| summary |
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/vercel/next.js |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
4.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/vercel/next.js |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.7 |
| purl |
pkg:npm/next@14.2.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-bwnq-891k-ykh7 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-jgpv-ueke-37gf |
|
| 12 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 13 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 14 |
| vulnerability |
VCID-pzbj-fkbg-nkdw |
|
| 15 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 16 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 17 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 18 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 19 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 20 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 21 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 22 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 23 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 24 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.7 |
|
|
| aliases |
CVE-2024-47831, GHSA-g77x-44xx-532m
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3614-49nb-r7em |
|
| 3 |
| url |
VCID-4kgz-73xy-xyb2 |
| vulnerability_id |
VCID-4kgz-73xy-xyb2 |
| summary |
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44580, GHSA-gx5p-jg67-6x7h
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4kgz-73xy-xyb2 |
|
| 4 |
| url |
VCID-93c9-up9w-5fdv |
| vulnerability_id |
VCID-93c9-up9w-5fdv |
| summary |
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44577, GHSA-h64f-5h5j-jqjh
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-93c9-up9w-5fdv |
|
| 5 |
| url |
VCID-b2hu-vcgt-7ydr |
| vulnerability_id |
VCID-b2hu-vcgt-7ydr |
| summary |
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44582, GHSA-vfv6-92ff-j949
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-b2hu-vcgt-7ydr |
|
| 6 |
| url |
VCID-bjvd-79eg-17f3 |
| vulnerability_id |
VCID-bjvd-79eg-17f3 |
| summary |
Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at the edge/proxy, and/or enforce authentication/authorization on backend routes. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@15.5.13 |
| purl |
pkg:npm/next@15.5.13 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.13 |
|
| 1 |
| url |
pkg:npm/next@16.1.7 |
| purl |
pkg:npm/next@16.1.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.7 |
|
|
| aliases |
CVE-2026-29057, GHSA-ggv3-7p47-pfv8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bjvd-79eg-17f3 |
|
| 7 |
| url |
VCID-bwnq-891k-ykh7 |
| vulnerability_id |
VCID-bwnq-891k-ykh7 |
| summary |
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/vercel/next.js |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/vercel/next.js |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.10 |
| purl |
pkg:npm/next@14.2.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-jgpv-ueke-37gf |
|
| 11 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 12 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 13 |
| vulnerability |
VCID-pzbj-fkbg-nkdw |
|
| 14 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 15 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 16 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 17 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 20 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 21 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 22 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 23 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.10 |
|
|
| aliases |
CVE-2024-46982, GHSA-gp8f-8m3g-qvj9
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bwnq-891k-ykh7 |
|
| 8 |
| url |
VCID-c9sc-ajq2-pyda |
| vulnerability_id |
VCID-c9sc-ajq2-pyda |
| summary |
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@15.0.8 |
| purl |
pkg:npm/next@15.0.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.0.8 |
|
| 1 |
| url |
pkg:npm/next@15.1.12 |
| purl |
pkg:npm/next@15.1.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.12 |
|
| 2 |
| url |
pkg:npm/next@15.2.9 |
| purl |
pkg:npm/next@15.2.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.2.9 |
|
| 3 |
| url |
pkg:npm/next@15.3.9 |
| purl |
pkg:npm/next@15.3.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.3.9 |
|
| 4 |
| url |
pkg:npm/next@15.4.11 |
| purl |
pkg:npm/next@15.4.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 12 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 13 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 14 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 15 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 16 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.11 |
|
| 5 |
| url |
pkg:npm/next@15.5.10 |
| purl |
pkg:npm/next@15.5.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.10 |
|
| 6 |
|
| 7 |
| url |
pkg:npm/next@16.0.11 |
| purl |
pkg:npm/next@16.0.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 11 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 12 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 13 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 14 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 15 |
| vulnerability |
VCID-v7dq-7t8n-j7b5 |
|
| 16 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 17 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 18 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 19 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 20 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.0.11 |
|
| 8 |
| url |
pkg:npm/next@16.1.5 |
| purl |
pkg:npm/next@16.1.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 13 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 14 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 15 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 16 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 17 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 18 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.5 |
|
|
| aliases |
GHSA-h25m-26qc-wcjf
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-c9sc-ajq2-pyda |
|
| 9 |
| url |
VCID-gm62-hv3y-v7b8 |
| vulnerability_id |
VCID-gm62-hv3y-v7b8 |
| summary |
Next Vulnerable to Denial of Service with Server Components |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.34 |
| purl |
pkg:npm/next@14.2.34 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 14 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.34 |
|
| 1 |
| url |
pkg:npm/next@14.3.0-canary.0 |
| purl |
pkg:npm/next@14.3.0-canary.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.3.0-canary.0 |
|
| 2 |
| url |
pkg:npm/next@15.0.6 |
| purl |
pkg:npm/next@15.0.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 15 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.0.6 |
|
| 3 |
| url |
pkg:npm/next@15.1.0 |
| purl |
pkg:npm/next@15.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-jgpv-ueke-37gf |
|
| 11 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 12 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 13 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 14 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 17 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 18 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 22 |
| vulnerability |
VCID-zrw8-shww-mqe4 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.0 |
|
| 4 |
| url |
pkg:npm/next@15.1.10 |
| purl |
pkg:npm/next@15.1.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 15 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.10 |
|
| 5 |
| url |
pkg:npm/next@15.2.7 |
| purl |
pkg:npm/next@15.2.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 14 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 15 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 16 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 17 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.2.7 |
|
| 6 |
| url |
pkg:npm/next@15.3.7 |
| purl |
pkg:npm/next@15.3.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 14 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 15 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 16 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 17 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.3.7 |
|
| 7 |
| url |
pkg:npm/next@15.4.9 |
| purl |
pkg:npm/next@15.4.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 18 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.9 |
|
| 8 |
| url |
pkg:npm/next@15.5.0 |
| purl |
pkg:npm/next@15.5.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.0 |
|
| 9 |
| url |
pkg:npm/next@15.5.8 |
| purl |
pkg:npm/next@15.5.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 18 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.8 |
|
| 10 |
|
| 11 |
| url |
pkg:npm/next@16.0.9 |
| purl |
pkg:npm/next@16.0.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 14 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-v7dq-7t8n-j7b5 |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 22 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.0.9 |
|
| 12 |
| url |
pkg:npm/next@16.1.0-canary.17 |
| purl |
pkg:npm/next@16.1.0-canary.17 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 14 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-v7dq-7t8n-j7b5 |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 22 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.0-canary.17 |
|
|
| aliases |
GHSA-mwv6-3258-q52c
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gm62-hv3y-v7b8 |
|
| 10 |
| url |
VCID-haxf-nay6-v3hg |
| vulnerability_id |
VCID-haxf-nay6-v3hg |
| summary |
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@15.5.15 |
| purl |
pkg:npm/next@15.5.15 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 9 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 10 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 11 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 12 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.15 |
|
| 1 |
| url |
pkg:npm/next@16.2.3 |
| purl |
pkg:npm/next@16.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 9 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 10 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 11 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 12 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.3 |
|
|
| aliases |
GHSA-q4gf-8mx6-v5v3
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-haxf-nay6-v3hg |
|
| 11 |
| url |
VCID-jgpv-ueke-37gf |
| vulnerability_id |
VCID-jgpv-ueke-37gf |
| summary |
Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.21 |
| purl |
pkg:npm/next@14.2.21 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 11 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 12 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 13 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 14 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 15 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 16 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 17 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 18 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 19 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 20 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 21 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.21 |
|
| 1 |
| url |
pkg:npm/next@15.1.2 |
| purl |
pkg:npm/next@15.1.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 12 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 13 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 14 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 15 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 16 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 17 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 18 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 19 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 20 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 21 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 22 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 23 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 24 |
| vulnerability |
VCID-zrw8-shww-mqe4 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.2 |
|
|
| aliases |
CVE-2024-56332, GHSA-7m27-7ghc-44w9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jgpv-ueke-37gf |
|
| 12 |
| url |
VCID-mv21-m5nh-vygs |
| vulnerability_id |
VCID-mv21-m5nh-vygs |
| summary |
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://vercel.com/changelog/cve-2025-48068 |
| reference_id |
cve-2025-48068 |
| reference_type |
|
| scores |
| 0 |
| value |
2.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
|
| 1 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-30T12:43:40Z/ |
|
|
| url |
https://vercel.com/changelog/cve-2025-48068 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.30 |
| purl |
pkg:npm/next@14.2.30 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 11 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 18 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.30 |
|
| 1 |
| url |
pkg:npm/next@14.3.0-canary.0 |
| purl |
pkg:npm/next@14.3.0-canary.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.3.0-canary.0 |
|
| 2 |
| url |
pkg:npm/next@15.2.2 |
| purl |
pkg:npm/next@15.2.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 9 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 10 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 11 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 14 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 15 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 16 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 17 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 18 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 19 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 20 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 21 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 22 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 23 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.2.2 |
|
|
| aliases |
CVE-2025-48068, GHSA-3h52-269p-cp9r
|
| risk_score |
1.9 |
| exploitability |
0.5 |
| weighted_severity |
3.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mv21-m5nh-vygs |
|
| 13 |
| url |
VCID-p7a7-ehjr-xqf3 |
| vulnerability_id |
VCID-p7a7-ehjr-xqf3 |
| summary |
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.31 |
| purl |
pkg:npm/next@14.2.31 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 11 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 16 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31 |
|
| 1 |
| url |
pkg:npm/next@15.4.5 |
| purl |
pkg:npm/next@15.4.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 9 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 10 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 11 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 14 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 15 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 16 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5 |
|
|
| aliases |
CVE-2025-57752, GHSA-g5qg-72qw-gw5v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p7a7-ehjr-xqf3 |
|
| 14 |
| url |
VCID-pzbj-fkbg-nkdw |
| vulnerability_id |
VCID-pzbj-fkbg-nkdw |
| summary |
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.15 |
| purl |
pkg:npm/next@14.2.15 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-jgpv-ueke-37gf |
|
| 11 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 12 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 13 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 14 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 17 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 18 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 22 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.15 |
|
|
| aliases |
CVE-2024-51479, GHSA-7gfc-8cq8-jh5f
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pzbj-fkbg-nkdw |
|
| 15 |
| url |
VCID-qyq6-dq1h-s7en |
| vulnerability_id |
VCID-qyq6-dq1h-s7en |
| summary |
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.1.1 |
| purl |
pkg:npm/next@14.1.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-3614-49nb-r7em |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-bwnq-891k-ykh7 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-jgpv-ueke-37gf |
|
| 12 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 13 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 14 |
| vulnerability |
VCID-pzbj-fkbg-nkdw |
|
| 15 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 16 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 17 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 18 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 19 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 20 |
| vulnerability |
VCID-xz2s-8drg-8bam |
|
| 21 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 22 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 23 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 24 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.1.1 |
|
|
| aliases |
CVE-2024-34351, GHSA-fr5h-rqp8-mj6g
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qyq6-dq1h-s7en |
|
| 16 |
| url |
VCID-s5uv-nxf7-rkbj |
| vulnerability_id |
VCID-s5uv-nxf7-rkbj |
| summary |
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.25 |
| purl |
pkg:npm/next@14.2.25 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-gsam-akzk-ukas |
|
| 10 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 11 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 12 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 13 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 14 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 15 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 16 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 17 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 18 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 19 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 20 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.25 |
|
| 1 |
| url |
pkg:npm/next@15.2.3 |
| purl |
pkg:npm/next@15.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 9 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 10 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 11 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 14 |
| vulnerability |
VCID-gsam-akzk-ukas |
|
| 15 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 16 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 17 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 18 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 19 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 20 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 21 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 22 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 23 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.2.3 |
|
|
| aliases |
CVE-2025-29927, GHSA-f82v-jwr5-mffw
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s5uv-nxf7-rkbj |
|
| 17 |
| url |
VCID-t6n1-e9kc-hqgx |
| vulnerability_id |
VCID-t6n1-e9kc-hqgx |
| summary |
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.32 |
| purl |
pkg:npm/next@14.2.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 15 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.32 |
|
| 1 |
| url |
pkg:npm/next@15.4.7 |
| purl |
pkg:npm/next@15.4.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 9 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 10 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 11 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 14 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 17 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 18 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 19 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 20 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.7 |
|
|
| aliases |
CVE-2025-57822, GHSA-4342-x723-ch2f
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t6n1-e9kc-hqgx |
|
| 18 |
| url |
VCID-uqrk-gg9y-5bfz |
| vulnerability_id |
VCID-uqrk-gg9y-5bfz |
| summary |
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`). |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@15.5.14 |
| purl |
pkg:npm/next@15.5.14 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.14 |
|
| 1 |
|
| 2 |
| url |
pkg:npm/next@16.1.7 |
| purl |
pkg:npm/next@16.1.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 1 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 2 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.7 |
|
|
| aliases |
CVE-2026-27980, GHSA-3x4c-7xq6-9pq8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uqrk-gg9y-5bfz |
|
| 19 |
| url |
VCID-wdsq-y8uf-2feh |
| vulnerability_id |
VCID-wdsq-y8uf-2feh |
| summary |
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.31 |
| purl |
pkg:npm/next@14.2.31 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 11 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 12 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 13 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 14 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 15 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 16 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.31 |
|
| 1 |
| url |
pkg:npm/next@15.4.5 |
| purl |
pkg:npm/next@15.4.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 9 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 10 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 11 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 14 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 15 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 16 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.5 |
|
|
| aliases |
CVE-2025-55173, GHSA-xv57-4mr9-wg8v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wdsq-y8uf-2feh |
|
| 20 |
| url |
VCID-wgv6-ermy-yycy |
| vulnerability_id |
VCID-wgv6-ermy-yycy |
| summary |
Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44581, GHSA-ffhc-5mcf-pf4q
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wgv6-ermy-yycy |
|
| 21 |
| url |
VCID-xz2s-8drg-8bam |
| vulnerability_id |
VCID-xz2s-8drg-8bam |
| summary |
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.24 |
| purl |
pkg:npm/next@14.2.24 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 11 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 12 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 13 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 14 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 15 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 16 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 17 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 18 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 19 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 20 |
| vulnerability |
VCID-zuh1-7568-nbg3 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.24 |
|
| 1 |
| url |
pkg:npm/next@15.1.6 |
| purl |
pkg:npm/next@15.1.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2rsy-25vf-cufu |
|
| 2 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 3 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 4 |
| vulnerability |
VCID-51mc-n64v-nugj |
|
| 5 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 6 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 7 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-gm62-hv3y-v7b8 |
|
| 12 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 13 |
| vulnerability |
VCID-mv21-m5nh-vygs |
|
| 14 |
| vulnerability |
VCID-p7a7-ehjr-xqf3 |
|
| 15 |
| vulnerability |
VCID-s5uv-nxf7-rkbj |
|
| 16 |
| vulnerability |
VCID-t6n1-e9kc-hqgx |
|
| 17 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 18 |
| vulnerability |
VCID-wdsq-y8uf-2feh |
|
| 19 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 20 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 21 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 22 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
| 23 |
| vulnerability |
VCID-zrw8-shww-mqe4 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.6 |
|
|
| aliases |
CVE-2025-32421, GHSA-qpjv-v59x-3qc4
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xz2s-8drg-8bam |
|
| 22 |
| url |
VCID-xzrf-tsxp-hqeg |
| vulnerability_id |
VCID-xzrf-tsxp-hqeg |
| summary |
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44572, GHSA-3g8h-86w9-wvmq
|
| risk_score |
2.6 |
| exploitability |
0.5 |
| weighted_severity |
5.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xzrf-tsxp-hqeg |
|
| 23 |
| url |
VCID-yddv-cunp-yyd7 |
| vulnerability_id |
VCID-yddv-cunp-yyd7 |
| summary |
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44578, GHSA-c4j6-fc7j-m34r
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-yddv-cunp-yyd7 |
|
| 24 |
| url |
VCID-zrny-u44x-3fh1 |
| vulnerability_id |
VCID-zrny-u44x-3fh1 |
| summary |
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh).
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments. |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-8h8q-6873-q5fj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zrny-u44x-3fh1 |
|
| 25 |
| url |
VCID-zuh1-7568-nbg3 |
| vulnerability_id |
VCID-zuh1-7568-nbg3 |
| summary |
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/next@14.2.35 |
| purl |
pkg:npm/next@14.2.35 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 4 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 5 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 6 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 7 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 8 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 9 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 10 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 11 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 12 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 13 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@14.2.35 |
|
| 1 |
| url |
pkg:npm/next@15.0.7 |
| purl |
pkg:npm/next@15.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.0.7 |
|
| 2 |
| url |
pkg:npm/next@15.1.11 |
| purl |
pkg:npm/next@15.1.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 7 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 8 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 9 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 10 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 11 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 12 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 13 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 14 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.1.11 |
|
| 3 |
| url |
pkg:npm/next@15.2.8 |
| purl |
pkg:npm/next@15.2.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 14 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 15 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 16 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.2.8 |
|
| 4 |
| url |
pkg:npm/next@15.3.8 |
| purl |
pkg:npm/next@15.3.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 14 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 15 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 16 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.3.8 |
|
| 5 |
| url |
pkg:npm/next@15.4.10 |
| purl |
pkg:npm/next@15.4.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.4.10 |
|
| 6 |
| url |
pkg:npm/next@15.5.9 |
| purl |
pkg:npm/next@15.5.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 4 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 5 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 6 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 7 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 8 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 9 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 10 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 11 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 12 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 13 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 14 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 15 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 16 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 17 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@15.5.9 |
|
| 7 |
|
| 8 |
| url |
pkg:npm/next@16.0.10 |
| purl |
pkg:npm/next@16.0.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 14 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-v7dq-7t8n-j7b5 |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.0.10 |
|
| 9 |
| url |
pkg:npm/next@16.1.0-canary.19 |
| purl |
pkg:npm/next@16.1.0-canary.19 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-29qk-jgck-2kb2 |
|
| 1 |
| vulnerability |
VCID-2wxy-d9mx-u7du |
|
| 2 |
| vulnerability |
VCID-4kgz-73xy-xyb2 |
|
| 3 |
| vulnerability |
VCID-51r9-nmc2-tyc7 |
|
| 4 |
| vulnerability |
VCID-5ehn-67ys-73h1 |
|
| 5 |
| vulnerability |
VCID-6r5c-d48p-9qa4 |
|
| 6 |
| vulnerability |
VCID-93c9-up9w-5fdv |
|
| 7 |
| vulnerability |
VCID-9r3b-phvp-xfck |
|
| 8 |
| vulnerability |
VCID-b2hu-vcgt-7ydr |
|
| 9 |
| vulnerability |
VCID-bjvd-79eg-17f3 |
|
| 10 |
| vulnerability |
VCID-c9sc-ajq2-pyda |
|
| 11 |
| vulnerability |
VCID-chsk-ka34-yqaf |
|
| 12 |
| vulnerability |
VCID-gh18-cr6c-47hm |
|
| 13 |
| vulnerability |
VCID-haxf-nay6-v3hg |
|
| 14 |
| vulnerability |
VCID-qptg-e7c6-puhs |
|
| 15 |
| vulnerability |
VCID-uqrk-gg9y-5bfz |
|
| 16 |
| vulnerability |
VCID-v7dq-7t8n-j7b5 |
|
| 17 |
| vulnerability |
VCID-w4pk-pmxb-c7fr |
|
| 18 |
| vulnerability |
VCID-wgv6-ermy-yycy |
|
| 19 |
| vulnerability |
VCID-xzrf-tsxp-hqeg |
|
| 20 |
| vulnerability |
VCID-yddv-cunp-yyd7 |
|
| 21 |
| vulnerability |
VCID-zrny-u44x-3fh1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/next@16.1.0-canary.19 |
|
|
| aliases |
GHSA-5j59-xgg2-r9c4
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zuh1-7568-nbg3 |
|