next
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 77 advisory(ies) without a verdict
Advisories (77)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts | 12.3.5 – < 12.3.6 ; 13.5.9 – < 13.5.10 ; 14.2.25 – < 14.2.26 ; … | Undetermined |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | 10.0.0 – < 15.5.28 ; 16.0.0 – < 16.4.1 | Undetermined |
| GHSA-25mp-g6fv-mqxx Unexpected server crash in Next.js. | 12.0.0 – < 12.0.5 ; 0.9.9 – < 11.1.3 | Undetermined |
| GHSA-267c-6grr-h53f Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes | 15.2.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-26hh-7cqf-hhc6 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up | 15.2.0 – < 15.5.18 ; 16.0.0 – < 16.2.6 | Undetermined |
| GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used | 10.0.0 – < 15.5.24 ; 16.0.0 – < 16.3.3 | Undetermined |
| GHSA-36qx-fr4f-26g5 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n | 12.2.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint | 16.0.0 – < 16.3.8 | Undetermined |
| GHSA-3f5c-4qxj-vmpf Next.js Directory Traversal Vulnerability | 1.0.0 – < 2.4.1 | Undetermined |
| GHSA-3g8h-86w9-wvmq Next.js's Middleware / Proxy redirects can be cache-poisoned | 12.2.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-3h52-269p-cp9r Information exposure in Next.js dev server due to lack of origin verification | 15.0.0 – < 15.2.2 ; 13.0 – < 14.2.30 | Undetermined |
| GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages | 16.3.0 – < 16.3.8 | Undetermined |
| GHSA-3x4c-7xq6-9pq8 Next.js: Unbounded next/image disk cache growth can exhaust storage | 16.0.0-beta.0 – < 16.1.7 ; 10.0.0 – < 15.5.14 | Undetermined |
| GHSA-4342-x723-ch2f Next.js Improper Middleware Redirect Handling Leads to SSRF | 0.9.9 – < 14.2.32 ; 15.0.0-canary.0 – < 15.4.7 | Undetermined |
| GHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences | 13.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-492v-c6pp-mqqv Next.js has a Middleware / Proxy bypass through dynamic route parameter injection | 15.4.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime | 13.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | 15.0.0 – < 15.5.27 ; 16.0.0 – < 16.3.8 | Undetermined |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint | 16.0.0-beta.0 – < 16.1.5 ; 15.0.0-canary.0 – 15.0.0-canary.205 ; 15.0.1-canary.0 – 15.0.1-canary.3 ; … | Undetermined |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | 13.3.1-canary.0 – < 14.2.35 ; 15.0.6 – < 15.0.7 ; 15.1.10 – < 15.1.11 ; … | Undetermined |
| GHSA-5vj8-3v2h-h38v Remote Code Execution in next | 0.9.9 – < 5.1.0 | Undetermined |
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays | 16.0.0 – < 16.4.1 | Undetermined |
| GHSA-67rr-84xm-4c7r Next.JS vulnerability can lead to DoS via cache poisoning | 15.0.4-canary.51 – < 15.1.8 | Undetermined |
| GHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies | 13.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-6gpp-xcg3-4w24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale | 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-77r5-gw3j-2mpf Next.js Vulnerable to HTTP Request Smuggling | 13.4.0 – < 13.5.1 | Undetermined |
| GHSA-7gfc-8cq8-jh5f Next.js authorization bypass vulnerability | 9.5.5 – < 14.2.15 | Undetermined |
| GHSA-7m27-7ghc-44w9 Next.js Allows a Denial of Service (DoS) with Server Actions | 13.0.0 – < 13.5.8 ; 14.0.0 – < 14.2.21 ; 15.0.0 – < 15.1.2 | Undetermined |
| GHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom servers | 14.1.1 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-8h8q-6873-q5fj Next.js Vulnerable to Denial of Service with Server Components | 13.0.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpoints | 13.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-9g9p-9gw9-jx7f Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | 10.0.0 – < 15.5.10 ; 15.6.0-canary.0 – < 16.1.5 | Undetermined |
| GHSA-9gr3-7897-pp7m XSS in Image Optimization API for Next.js | 10.0.0 – < 11.1.1 | Undetermined |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol | 14.3.0-canary.77 – < 15.0.5 ; 15.1.0-canary.0 – < 15.1.9 ; 15.2.0-canary.0 – < 15.2.6 ; … | Undetermined |
| GHSA-c4j6-fc7j-m34r Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades | 13.4.13 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-c59h-r6p8-q9wc Next.js missing cache-control header may lead to CDN caching empty reply | 0.9.9 – < 13.4.20-canary.13 | Undetermined |
| GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization | 16.0.0 – < 16.3.8 | Undetermined |
| GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware | 13.0.0 – < 13.5.9 ; 14.0.0 – < 14.2.25 ; 15.0.0 – < 15.2.3 ; … | Undetermined |
| GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass | 16.0.0 – < 16.3.8 | Undetermined |
| GHSA-ffhc-5mcf-pf4q Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces | 13.4.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-fmvm-x8mv-47mj Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 | 10.0.0 – < 12.1.0 | Undetermined |
| GHSA-fq54-2j52-jc42 Next.js Denial of Service (DoS) condition | 13.3.1 – < 13.5.0 | Undetermined |
| GHSA-fq77-7p7r-83rj Directory Traversal in Next.js | 0.9.9 – < 9.3.2 | Undetermined |
| GHSA-fr5h-rqp8-mj6g Next.js Server-Side Request Forgery in Server Actions | 13.4.0 – < 14.1.1 | Undetermined |
| GHSA-g5qg-72qw-gw5v Next.js Affected by Cache Key Confusion for Image Optimization API Routes | 0.9.9 – < 14.2.31 ; 15.0.0 – < 15.4.5 | Undetermined |
| GHSA-g77x-44xx-532m Denial of Service condition in Next.js image optimization | 10.0.0 – < 14.2.7 | Undetermined |
| GHSA-ggv3-7p47-pfv8 Next.js: HTTP request smuggling in rewrites | 16.0.0-beta.0 – < 16.1.7 ; 9.5.0 – < 15.5.13 | Undetermined |
| GHSA-gp8f-8m3g-qvj9 Next.js Cache Poisoning | 13.5.1 – < 13.5.7 ; 14.0.0 – < 14.2.10 | Undetermined |
| GHSA-gx5p-jg67-6x7h Next.js has cross-site scripting in beforeInteractive scripts with untrusted input | 13.0.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components | 13.0.0 – < 15.0.8 ; 15.1.1-canary.0 – < 15.1.12 ; 15.2.0-canary.0 – < 15.2.9 ; … | Undetermined |
| GHSA-h27x-g6w4-24gq Next.js: Unbounded postponed resume buffering can lead to DoS | 16.0.1 – < 16.1.7 | Undetermined |
| GHSA-h64f-5h5j-jqjh Next.js has a Denial of Service in the Image Optimization API | 10.0.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-h694-7cp9-m8p3 next.js cache leak across root param values in nested 'use cache' functions | 16.3.0 – < 16.3.8 | Undetermined |
| GHSA-jcc7-9wpm-mj36 Next.js: null origin can bypass dev HMR websocket CSRF checks | 16.0.1 – < 16.1.7 | Undetermined |
| GHSA-m34x-wgrh-g897 Directory traversal vulnerability in Next.js | 1.0.0 – < 4.2.3 | Undetermined |
| GHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions | 13.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | 16.0.0 – < 16.3.8 ; 15.0.0 – < 15.5.27 | Undetermined |
| GHSA-mg66-mrh9-m8jx Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components | 15.0.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-mq59-m269-xvcx Next.js: null origin can bypass Server Actions CSRF checks | 16.0.1 – < 16.1.7 | Undetermined |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components | 13.3.0 – < 14.2.34 ; 15.0.0-canary.0 – < 15.0.6 ; 15.1.1-canary.0 – < 15.1.10 ; … | Undetermined |
| GHSA-p293-qw3h-jr36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers | 13.4.0 – < 15.5.24 ; 16.0.0 – < 16.3.3 | Undetermined |
| GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions | 13.0.0 – < 15.5.28 ; 16.0.0 – < 16.4.1 | Undetermined |
| GHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname | 12.0.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-q4gf-8mx6-v5v3 Next.js has a Denial of Service with Server Components | 13.0.0 – < 15.5.15 ; 16.0.0-beta.0 – < 16.2.3 | Undetermined |
| GHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs | 15.5.0 – < 15.5.21 ; 16.0.0 – < 16.2.11 | Undetermined |
| GHSA-qpjv-v59x-3qc4 Next.js Race Condition to Cache Poisoning | 0.9.9 – < 14.2.24 ; 15.0.0 – < 15.1.6 | Undetermined |
| GHSA-qw96-mm2g-c8m7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page | 7.0.0 – < 7.0.2 | Undetermined |
| GHSA-r2fc-ccr8-96c4 Next.js has a Cache poisoning vulnerability due to omission of the Vary header | 15.3.0 – < 15.3.3 | Undetermined |
| GHSA-vcvr-r3jv-pc5j Next.js: Remote Code Execution in next/og ImageResponse | 16.2.0 – < 16.3.6 | Undetermined |
| GHSA-vfv6-92ff-j949 Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting | 13.4.6 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-vxf5-wxwp-m7g9 Open Redirect in Next.js | 0.9.9 – < 11.1.0 | Undetermined |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure | 15.0.0-canary.0 – < 15.0.6 ; 15.1.1-canary.0 – < 15.1.10 ; 15.2.0-canary.0 – < 15.2.7 ; … | Undetermined |
| GHSA-wfc6-r584-vfw7 Next.js vulnerable to cache poisoning in React Server Component responses | 14.2.0 – < 15.5.16 ; 16.0.0 – < 16.2.5 | Undetermined |
| GHSA-wff4-fpwg-qqv3 Unexpected server crash in Next.js | 12.2.3 – < 12.2.4 | Undetermined |
| GHSA-wr66-vrwm-5g5x Denial of Service Vulnerability in next.js | 12.0.0 – < 12.0.9 | Undetermined |
| GHSA-x56p-c8cg-q435 Open Redirect in Next.js versions | 9.5.0 – < 9.5.4 | Undetermined |
| GHSA-xv57-4mr9-wg8v Next.js Content Injection Vulnerability for Image Optimization | 0.9.9 – < 14.2.31 ; 15.0.0 – < 15.4.5 | Undetermined |
Sources
| Source | Licence |
|---|