{"id":"CVE-2026-27977","aliases":["CLSA-2026-1786710099","CLSA-2026-1792195747","CLSA-2026-1792196876","CLSA-2026-1792206291","CLSA-2026-1792256965","CLSA-2026-1792272245","CLSA-2026-1792293015","CLSA-2026-1792304740","CLSA-2026-1792326308","CLSA-2026-1792338234","CLSA-2026-1792346469","CLSA-2026-1792358598","CLSA-2026-1792364005","CLSA-2026-1792367390","EUVD-2026-12683","GHSA-8h8q-6873-q5fj","GHSA-h25m-26qc-wcjf","GHSA-jcc7-9wpm-mj36","GHSA-q4gf-8mx6-v5v3","GHSA-w37m-7fhw-fmv9","ROOT-APP-NPM-CVE-2026-27977","ROOT-APP-NPM-GHSA-8h8q-6873-q5fj","ROOT-APP-NPM-GHSA-h25m-26qc-wcjf","ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3"],"status":"published","title":"Next.js: null origin can bypass dev HMR websocket CSRF checks","description":"Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00182,"percentile":0.07862,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1385","CWE-1395","CWE-400","CWE-497","CWE-502","CWE-770"],"published":"2025-12-11T22:49:56Z","modified":"2026-11-02T11:15:06Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.5.16","16.2.5","15.0.8","15.1.12","15.2.9","15.3.9","15.4.11","15.5.10","15.6.0-canary.61","16.0.11","16.1.5","16.1.7","15.5.15","16.2.3","15.0.6","15.1.10","15.2.7","15.3.7","15.4.9","15.5.8","15.6.0-canary.59","16.0.9","16.1.0-canary.17"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.1.6-aikido.5","16.1.6-aikido.6","16.1.6-aikido.7","16.1.6-aikido.8","16.1.7-aikido.1","16.1.7-aikido.2","16.1.7-aikido.3","14.2.5-aikido.5","14.2.5-aikido.8","14.2.35-aikido.9","14.2.30-aikido.7","14.2.26-aikido.6","14.2.26-aikido.4","14.2.30-aikido.10","13.4.19-aikido.6","13.4.19-aikido.7","14.2.10-aikido.3","14.2.13-aikido.3","14.0.4-aikido.6","14.2.3-aikido.1","14.0.4-aikido.9","14.2.24-aikido.2","14.2.25-aikido.2","14.1.0-aikido.4","14.2.18-aikido.2","13.3.0-aikido.5","14.0.4-aikido.5","14.0.4-aikido.7","14.0.4-aikido.2","14.1.0-aikido.7","14.1.0-aikido.8","14.0.4-aikido.3","14.2.13-aikido.1","14.2.3-aikido.5","14.2.0-aikido.2","14.0.3-aikido.3","14.2.5-aikido.9","14.2.5-aikido.10","14.2.2-aikido.7","14.2.10-aikido.1","14.2.29-aikido.5","14.2.31-aikido.2","14.2.18-aikido.1","14.0.0-aikido.7","14.2.10-aikido.4","14.2.13-aikido.4","14.2.10-aikido.2","14.2.18-aikido.6","14.2.21-aikido.6","14.2.16-aikido.6","14.1.4-aikido.5","14.2.25-aikido.1","13.2.4-aikido.3","14.2.0-aikido.6","14.0.4-aikido.4","14.2.31-aikido.5","14.2.0-aikido.5","14.2.2-aikido.9","14.2.30-aikido.8","13.1.6-aikido.1","13.2.4-aikido.4","14.0.3-aikido.6","14.0.0-aikido.5","14.2.5-aikido.2","14.2.5-aikido.3","14.2.3-aikido.3","13.5.11-aikido.7","13.5.4-aikido.5","14.2.5-aikido.4","13.3.0-aikido.6","14.2.30-aikido.3","14.0.3-aikido.4","14.2.13-aikido.2","14.2.5-aikido.6","14.2.21-aikido.4","14.0.0-aikido.3","14.1.4-aikido.7","14.2.21-aikido.2","14.2.16-aikido.2","14.2.16-aikido.4","13.5.4-aikido.2","14.2.30-aikido.4","13.2.4-aikido.5","13.3.0-aikido.7","14.2.26-aikido.3","14.0.3-aikido.5","14.2.30-aikido.9","15.5.10-aikido.4","14.1.4-aikido.8","13.5.4-aikido.6","14.2.16-aikido.5","14.0.0-aikido.6","14.2.21-aikido.5","14.2.5-aikido.7","14.2.3-aikido.4","14.2.2-aikido.8","13.4.19-aikido.4","14.2.15-aikido.5","14.2.30-aikido.5","14.2.3-aikido.2","15.5.10-aikido.5","14.2.28-aikido.5","14.1.4-aikido.9","13.2.4-aikido.2","16.1.6-aikido.4","13.5.6-aikido.5","14.2.15-aikido.6","15.5.15-aikido.2","14.1.3-aikido.8","13.2.4-aikido.7","14.2.32-aikido.8","14.2.29-aikido.4","14.2.33-aikido.5","13.5.6-aikido.6","13.5.11-aikido.8","14.2.26-aikido.5","15.5.10-aikido.6","14.2.26-aikido.2","14.0.4-aikido.8","14.2.28-aikido.3","14.2.31-aikido.3","14.1.4-aikido.6","14.2.18-aikido.3","13.3.0-aikido.4","14.1.0-aikido.5","14.2.16-aikido.3","14.0.0-aikido.4","14.1.0-aikido.3","13.5.11-aikido.6","14.2.18-aikido.4","13.5.4-aikido.3","14.2.31-aikido.1","14.1.4-aikido.3","14.2.0-aikido.3","13.4.19-aikido.5","15.5.15-aikido.3","14.2.31-aikido.4","14.1.4-aikido.4","13.5.4-aikido.4","15.5.15-aikido.4","13.3.0-aikido.8","13.1.6-aikido.2","14.2.21-aikido.3","13.2.4-aikido.6","13.5.11-aikido.9","14.2.0-aikido.4","14.2.30-aikido.6","14.2.28-aikido.4","14.2.33-aikido.6","14.1.0-aikido.6","15.5.10-aikido.3","14.2.18-aikido.5","13.5.6-aikido.7","14.2.35-aikido.10","14.2.35-aikido.11","16.2.5-aikido.1","16.2.5-aikido.3","16.2.5-aikido.2","14.2.33-aikido.2","14.2.32-aikido.4","14.2.15-aikido.4","14.1.3-aikido.2","14.2.15-aikido.3","14.2.32-aikido.1","14.2.33-aikido.1","14.1.3-aikido.5","14.2.29-aikido.1","14.2.32-aikido.5","14.2.33-aikido.3","14.2.2-aikido.5","14.2.2-aikido.6","14.2.30-aikido.1","14.2.30-aikido.2","14.1.3-aikido.6","14.2.35-aikido.5","14.2.33-aikido.4","14.2.35-aikido.3","14.2.32-aikido.6","14.2.35-aikido.6","14.1.3-aikido.7","14.2.32-aikido.2","14.2.32-aikido.7","14.2.28-aikido.1","14.2.35-aikido.2","14.2.28-aikido.2","14.2.35-aikido.7","14.0.0-aikido.2","14.2.29-aikido.2","14.2.21-aikido.1","14.2.16-aikido.1","14.1.3-aikido.3","14.2.32-aikido.3","14.2.29-aikido.3","14.1.3-aikido.4","14.2.35-aikido.8","14.2.35-aikido.4","14.2.35-aikido.1","13.4.19-aikido.2","13.4.19-aikido.3","14.2.24-aikido.7","14.2.24-aikido.4","14.2.2-aikido.4","14.0.0-aikido.1","13.3.0-aikido.1","13.4.19-aikido.1","13.5.11-aikido.4","14.0.3-aikido.1","13.5.6-aikido.1","13.5.4-aikido.1","13.3.0-aikido.2","13.5.6-aikido.2","14.2.24-aikido.5","13.5.6-aikido.3","13.5.6-aikido.4","14.2.24-aikido.1","14.1.3-aikido.1","13.3.0-aikido.3","14.2.24-aikido.6","13.5.11-aikido.5","14.2.24-aikido.3","14.0.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.1.6-root.io.5","16.1.6-root.io.6","16.1.6-root.io.7","16.1.6-root.io.8","16.1.7-root.io.1","16.1.7-root.io.2","16.1.7-root.io.3","14.2.5-root.io.5","14.2.5-root.io.8","14.2.35-root.io.9","14.2.30-root.io.7","14.2.26-root.io.6","14.2.26-root.io.4","14.2.30-root.io.10","13.4.19-root.io.6","13.4.19-root.io.7","14.2.10-root.io.3","14.2.13-root.io.3","14.0.4-root.io.6","14.2.3-root.io.1","14.0.4-root.io.9","14.2.25-root.io.2","14.2.24-root.io.2","14.1.0-root.io.4","14.2.18-root.io.2","13.3.0-root.io.5","14.0.4-root.io.5","14.0.4-root.io.7","14.0.4-root.io.2","14.1.0-root.io.7","14.1.0-root.io.8","14.0.4-root.io.3","14.2.13-root.io.1","14.2.3-root.io.5","14.2.0-root.io.2","14.0.3-root.io.3","14.2.5-root.io.9","14.2.5-root.io.10","14.2.2-root.io.7","14.2.10-root.io.1","14.2.29-root.io.5","14.2.31-root.io.2","14.2.18-root.io.1","14.0.0-root.io.7","14.2.10-root.io.4","14.2.13-root.io.4","14.2.10-root.io.2","14.2.18-root.io.6","14.2.21-root.io.6","14.2.16-root.io.6","14.1.4-root.io.5","14.2.25-root.io.1","13.2.4-root.io.3","14.2.0-root.io.6","14.0.4-root.io.4","14.2.31-root.io.5","14.2.0-root.io.5","14.2.2-root.io.9","14.2.30-root.io.8","13.1.6-root.io.1","13.2.4-root.io.4","14.0.3-root.io.6","14.0.0-root.io.5","14.2.5-root.io.2","14.2.5-root.io.3","15.5.15-root.io.1","16.1.6-root.io.3","14.2.3-root.io.3","13.5.4-root.io.5","13.5.11-root.io.7","14.2.5-root.io.4","13.3.0-root.io.6","14.2.30-root.io.3","14.0.3-root.io.4","14.2.13-root.io.2","14.2.5-root.io.6","14.2.21-root.io.4","14.0.0-root.io.3","14.1.4-root.io.7","14.2.21-root.io.2","14.2.16-root.io.2","14.2.16-root.io.4","13.5.4-root.io.2","14.2.30-root.io.4","13.2.4-root.io.5","13.3.0-root.io.7","14.2.26-root.io.3","14.0.3-root.io.5","14.2.30-root.io.9","15.5.10-root.io.4","14.1.4-root.io.8","13.5.4-root.io.6","14.2.16-root.io.5","14.0.0-root.io.6","14.2.21-root.io.5","14.2.5-root.io.7","14.2.3-root.io.4","14.2.2-root.io.8","13.4.19-root.io.4","14.2.15-root.io.5","14.2.30-root.io.5","14.2.3-root.io.2","15.5.10-root.io.5","14.2.28-root.io.5","14.1.4-root.io.9","13.2.4-root.io.2","16.1.6-root.io.4","13.5.6-root.io.5","14.2.15-root.io.6","13.2.4-root.io.7","15.5.15-root.io.2","14.1.3-root.io.8","14.2.32-root.io.8","14.2.29-root.io.4","14.2.33-root.io.5","13.5.6-root.io.6","13.5.11-root.io.8","14.2.26-root.io.5","15.5.10-root.io.6","14.2.26-root.io.2","14.0.4-root.io.8","14.2.28-root.io.3","14.2.31-root.io.3","14.1.4-root.io.6","14.2.18-root.io.3","13.3.0-root.io.4","14.1.0-root.io.5","14.2.16-root.io.3","14.0.0-root.io.4","14.1.0-root.io.3","13.5.11-root.io.6","14.2.18-root.io.4","13.5.4-root.io.3","14.2.31-root.io.1","14.1.4-root.io.3","14.2.0-root.io.3","13.4.19-root.io.5","14.2.31-root.io.4","15.5.15-root.io.3","14.1.4-root.io.4","13.5.4-root.io.4","15.5.15-root.io.4","13.3.0-root.io.8","13.1.6-root.io.2","14.2.21-root.io.3","13.2.4-root.io.6","13.5.11-root.io.9","14.2.0-root.io.4","14.2.30-root.io.6","14.2.33-root.io.6","14.2.28-root.io.4","14.1.0-root.io.6","15.5.10-root.io.3","13.5.6-root.io.7","14.2.18-root.io.5","14.2.35-root.io.10","14.2.35-root.io.11","16.2.5-root.io.1","16.2.5-root.io.3","16.2.5-root.io.2","14.2.33-root.io.2","14.2.32-root.io.4","14.2.15-root.io.4","14.1.3-root.io.2","14.2.15-root.io.3","14.2.32-root.io.1","14.2.33-root.io.1","14.1.3-root.io.5","14.2.29-root.io.1","14.2.32-root.io.5","14.2.33-root.io.3","14.2.2-root.io.5","14.2.2-root.io.6","14.2.30-root.io.1","14.2.30-root.io.2","14.1.3-root.io.6","14.2.35-root.io.5","14.2.33-root.io.4","14.2.35-root.io.3","14.2.32-root.io.6","14.2.35-root.io.6","14.1.3-root.io.7","14.2.32-root.io.2","14.2.32-root.io.7","14.2.28-root.io.1","14.2.35-root.io.2","14.2.28-root.io.2","14.2.35-root.io.7","14.0.0-root.io.2","14.2.29-root.io.2","14.2.21-root.io.1","14.1.3-root.io.3","14.2.16-root.io.1","14.2.32-root.io.3","14.2.29-root.io.3","14.1.3-root.io.4","14.2.35-root.io.8","14.2.35-root.io.4","14.2.35-root.io.1","13.4.19-root.io.2","13.4.19-root.io.3","14.2.24-root.io.7","14.2.24-root.io.4","16.1.6-root.io.1","16.1.6-root.io.2","14.2.2-root.io.4","14.0.0-root.io.1","13.3.0-root.io.1","13.4.19-root.io.1","13.5.11-root.io.4","14.0.3-root.io.1","13.5.6-root.io.1","13.5.4-root.io.1","13.3.0-root.io.2","13.5.6-root.io.2","14.2.24-root.io.5","13.5.6-root.io.3","13.5.6-root.io.4","14.2.24-root.io.1","14.1.3-root.io.1","13.3.0-root.io.3","14.2.24-root.io.6","13.5.11-root.io.5","14.2.24-root.io.3","14.0.3-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.5.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.12"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.61"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.1"},{"fixed":"16.1.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.5.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.2.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.6"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.16"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.12"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.11"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.61"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.11"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.5"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.1"},{"fixed":"16.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.15"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-aikido.5"},{"fixed":"16.1.6-aikido.6"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.6-aikido.8"},{"fixed":"16.1.7-aikido.1"},{"fixed":"16.1.7-aikido.2"},{"fixed":"16.1.7-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-root.io.5"},{"fixed":"16.1.6-root.io.6"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"16.1.7-root.io.1"},{"fixed":"16.1.7-root.io.2"},{"fixed":"16.1.7-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.5"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.2.3-aikido.1"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.0.4-aikido.2"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.0.4-aikido.3"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.10-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.2.18-aikido.1"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.10-aikido.2"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.1.4-aikido.5"},{"fixed":"14.2.25-aikido.1"},{"fixed":"13.2.4-aikido.3"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.0.4-aikido.4"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"13.2.4-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.5-aikido.2"},{"fixed":"14.2.5-aikido.3"},{"fixed":"14.2.3-aikido.3"},{"fixed":"13.5.11-aikido.7"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.2.5-aikido.4"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.2.30-aikido.3"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.5-aikido.6"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.2.4-aikido.5"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"15.5.10-aikido.4"},{"fixed":"14.1.4-aikido.8"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.5-aikido.7"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"15.5.10-aikido.5"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.1.4-aikido.9"},{"fixed":"13.2.4-aikido.2"},{"fixed":"16.1.6-aikido.4"},{"fixed":"16.1.7-aikido.1"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"16.1.6-aikido.5"},{"fixed":"15.5.15-aikido.2"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"16.1.7-aikido.2"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.1.0-aikido.3"},{"fixed":"13.5.11-aikido.6"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.31-aikido.1"},{"fixed":"14.1.4-aikido.3"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"15.5.15-aikido.3"},{"fixed":"16.1.6-aikido.6"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.1.4-aikido.4"},{"fixed":"13.5.4-aikido.4"},{"fixed":"15.5.15-aikido.4"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"13.2.4-aikido.6"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"15.5.10-aikido.3"},{"fixed":"16.1.6-aikido.8"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"16.2.5-aikido.1"},{"fixed":"16.2.5-aikido.3"},{"fixed":"16.2.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.5"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.2.3-root.io.1"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.0.4-root.io.5"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.0.4-root.io.2"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.0.4-root.io.3"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.10-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.2.18-root.io.1"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.10-root.io.2"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.1.4-root.io.5"},{"fixed":"14.2.25-root.io.1"},{"fixed":"13.2.4-root.io.3"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.0.4-root.io.4"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"13.2.4-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.5-root.io.2"},{"fixed":"14.2.5-root.io.3"},{"fixed":"15.5.15-root.io.1"},{"fixed":"16.1.6-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.5-root.io.4"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.2.30-root.io.3"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.5-root.io.6"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.2.4-root.io.5"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"15.5.10-root.io.4"},{"fixed":"14.1.4-root.io.8"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.5-root.io.7"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"15.5.10-root.io.5"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.1.4-root.io.9"},{"fixed":"13.2.4-root.io.2"},{"fixed":"16.1.6-root.io.4"},{"fixed":"16.1.7-root.io.1"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"16.1.6-root.io.5"},{"fixed":"13.2.4-root.io.7"},{"fixed":"15.5.15-root.io.2"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.33-root.io.5"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"16.1.7-root.io.2"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.1.0-root.io.3"},{"fixed":"13.5.11-root.io.6"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.31-root.io.1"},{"fixed":"14.1.4-root.io.3"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.2.31-root.io.4"},{"fixed":"15.5.15-root.io.3"},{"fixed":"16.1.6-root.io.6"},{"fixed":"14.1.4-root.io.4"},{"fixed":"13.5.4-root.io.4"},{"fixed":"15.5.15-root.io.4"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"13.3.0-root.io.8"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"13.2.4-root.io.6"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"15.5.10-root.io.3"},{"fixed":"13.5.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"16.2.5-root.io.1"},{"fixed":"16.2.5-root.io.3"},{"fixed":"16.2.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.5"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.2.15-aikido.4"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.2.15-aikido.3"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.0.4-aikido.2"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.0.4-aikido.3"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.32-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.1.4-aikido.5"},{"fixed":"14.2.25-aikido.1"},{"fixed":"13.2.4-aikido.3"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.0.4-aikido.4"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"13.2.4-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.5-aikido.3"},{"fixed":"14.2.3-aikido.3"},{"fixed":"14.2.2-aikido.5"},{"fixed":"13.5.11-aikido.7"},{"fixed":"14.2.2-aikido.6"},{"fixed":"14.2.30-aikido.1"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.2.30-aikido.2"},{"fixed":"14.1.3-aikido.6"},{"fixed":"14.2.5-aikido.4"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.2.30-aikido.3"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.5-aikido.6"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.35-aikido.5"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.2.4-aikido.5"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.35-aikido.3"},{"fixed":"14.2.32-aikido.6"},{"fixed":"14.2.35-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.5-aikido.7"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.28-aikido.1"},{"fixed":"14.2.35-aikido.2"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"14.2.28-aikido.2"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.35-aikido.7"},{"fixed":"14.2.18-aikido.3"},{"fixed":"14.1.0-aikido.5"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.0.0-aikido.2"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"14.2.16-aikido.1"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"13.2.4-aikido.6"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.35-aikido.8"},{"fixed":"14.2.35-aikido.4"},{"fixed":"14.2.35-aikido.1"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.10-aikido.4"},{"fixed":"15.5.10-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"15.5.10-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.5"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.2.15-root.io.4"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.2.15-root.io.3"},{"fixed":"14.0.4-root.io.5"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.0.4-root.io.2"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.0.4-root.io.3"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.32-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.1.4-root.io.5"},{"fixed":"14.2.25-root.io.1"},{"fixed":"13.2.4-root.io.3"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.0.4-root.io.4"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"13.2.4-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.5-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.2.2-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.2-root.io.6"},{"fixed":"14.2.30-root.io.1"},{"fixed":"14.2.30-root.io.2"},{"fixed":"14.1.3-root.io.6"},{"fixed":"14.2.5-root.io.4"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.2.30-root.io.3"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.5-root.io.6"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.35-root.io.5"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.2.4-root.io.5"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.35-root.io.3"},{"fixed":"14.2.32-root.io.6"},{"fixed":"14.2.35-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.5-root.io.7"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"13.2.4-root.io.7"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.28-root.io.1"},{"fixed":"14.2.33-root.io.5"},{"fixed":"14.2.35-root.io.2"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"14.2.28-root.io.2"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.2.35-root.io.7"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"14.1.0-root.io.5"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.0.0-root.io.2"},{"fixed":"14.2.31-root.io.4"},{"fixed":"14.2.29-root.io.2"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"14.2.16-root.io.1"},{"fixed":"13.3.0-root.io.8"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"13.2.4-root.io.6"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"14.2.35-root.io.8"},{"fixed":"14.2.35-root.io.4"},{"fixed":"13.5.6-root.io.7"},{"fixed":"14.2.35-root.io.1"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.10-root.io.4"},{"fixed":"15.5.10-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"15.5.10-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.0.4-aikido.9"},{"fixed":"13.4.19-aikido.2"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"13.3.0-aikido.5"},{"fixed":"13.4.19-aikido.3"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.2.32-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.2.25-aikido.1"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"14.2.24-aikido.7"},{"fixed":"14.2.24-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.3-aikido.3"},{"fixed":"14.2.2-aikido.4"},{"fixed":"14.2.2-aikido.5"},{"fixed":"13.5.11-aikido.7"},{"fixed":"14.2.2-aikido.6"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.0.0-aikido.1"},{"fixed":"14.1.3-aikido.6"},{"fixed":"13.3.0-aikido.1"},{"fixed":"13.3.0-aikido.6"},{"fixed":"13.4.19-aikido.1"},{"fixed":"14.0.3-aikido.4"},{"fixed":"13.5.11-aikido.4"},{"fixed":"14.0.3-aikido.1"},{"fixed":"14.2.21-aikido.4"},{"fixed":"13.5.6-aikido.1"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"13.5.4-aikido.1"},{"fixed":"14.2.21-aikido.2"},{"fixed":"13.3.0-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.35-aikido.5"},{"fixed":"13.5.6-aikido.2"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"15.5.10-aikido.4"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.35-aikido.3"},{"fixed":"14.2.32-aikido.6"},{"fixed":"14.2.35-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.2.24-aikido.5"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"13.5.6-aikido.3"},{"fixed":"13.5.6-aikido.4"},{"fixed":"15.5.10-aikido.5"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.24-aikido.1"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"16.1.6-aikido.4"},{"fixed":"14.1.3-aikido.1"},{"fixed":"16.1.7-aikido.1"},{"fixed":"13.3.0-aikido.3"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"16.1.6-aikido.5"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.35-aikido.2"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.2.24-aikido.6"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.35-aikido.7"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"16.1.7-aikido.2"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"13.5.11-aikido.5"},{"fixed":"14.1.0-aikido.3"},{"fixed":"13.5.11-aikido.6"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.0.0-aikido.2"},{"fixed":"16.1.6-aikido.6"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"14.2.24-aikido.3"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.0.3-aikido.2"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.35-aikido.8"},{"fixed":"14.2.35-aikido.4"},{"fixed":"15.5.10-aikido.3"},{"fixed":"16.1.6-aikido.8"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.15-aikido.2"},{"fixed":"15.5.15-aikido.3"},{"fixed":"15.5.15-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.0.4-root.io.9"},{"fixed":"13.4.19-root.io.2"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.0.4-root.io.5"},{"fixed":"13.4.19-root.io.3"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.2.32-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.2.25-root.io.1"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"14.2.24-root.io.7"},{"fixed":"14.2.24-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"16.1.6-root.io.1"},{"fixed":"16.1.6-root.io.2"},{"fixed":"16.1.6-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"14.2.2-root.io.4"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.2.2-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.2-root.io.6"},{"fixed":"14.0.0-root.io.1"},{"fixed":"14.1.3-root.io.6"},{"fixed":"13.3.0-root.io.1"},{"fixed":"13.3.0-root.io.6"},{"fixed":"13.4.19-root.io.1"},{"fixed":"14.0.3-root.io.4"},{"fixed":"13.5.11-root.io.4"},{"fixed":"14.0.3-root.io.1"},{"fixed":"14.2.21-root.io.4"},{"fixed":"13.5.6-root.io.1"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"13.5.4-root.io.1"},{"fixed":"14.2.21-root.io.2"},{"fixed":"13.3.0-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.35-root.io.5"},{"fixed":"13.5.6-root.io.2"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"15.5.10-root.io.4"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.35-root.io.3"},{"fixed":"14.2.32-root.io.6"},{"fixed":"14.2.35-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.2.24-root.io.5"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"13.5.6-root.io.3"},{"fixed":"13.5.6-root.io.4"},{"fixed":"15.5.10-root.io.5"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.24-root.io.1"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"16.1.6-root.io.4"},{"fixed":"14.1.3-root.io.1"},{"fixed":"16.1.7-root.io.1"},{"fixed":"13.3.0-root.io.3"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"16.1.6-root.io.5"},{"fixed":"13.2.4-root.io.7"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.33-root.io.5"},{"fixed":"14.2.35-root.io.2"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.24-root.io.6"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.2.35-root.io.7"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"16.1.7-root.io.2"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"13.5.11-root.io.5"},{"fixed":"14.1.0-root.io.3"},{"fixed":"13.5.11-root.io.6"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.0.0-root.io.2"},{"fixed":"14.2.31-root.io.4"},{"fixed":"16.1.6-root.io.6"},{"fixed":"14.2.29-root.io.2"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"13.3.0-root.io.8"},{"fixed":"14.2.24-root.io.3"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.0.3-root.io.2"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"14.2.35-root.io.8"},{"fixed":"14.2.35-root.io.4"},{"fixed":"15.5.10-root.io.3"},{"fixed":"13.5.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.15-root.io.1"},{"fixed":"15.5.15-root.io.2"},{"fixed":"15.5.15-root.io.3"},{"fixed":"15.5.15-root.io.4"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.1.7","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh","tags":["web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj","tags":["web"]},{"url":"https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8h8q-6873-q5fj"},{"url":"https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg","tags":["web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23864","tags":["advisory"]},{"url":"https://vercel.com/changelog/summary-of-cve-2026-23864","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h25m-26qc-wcjf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27977","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jcc7-9wpm-mj36"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3","tags":["web"]},{"url":"https://vercel.com/changelog/summary-of-cve-2026-23869","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q4gf-8mx6-v5v3"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9","tags":["web"]},{"url":"https://nextjs.org/blog/security-update-2025-12-11","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55183","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w37m-7fhw-fmv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27977.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27977","title":"Next.js: null origin can bypass dev HMR websocket CSRF checks","description":"Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.","status":"published","published":"2026-03-17T23:56:24.631Z","modified":"2026-03-18T19:56:16.843Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-1385"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-12683","description":"Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.","status":"published","published":"2026-03-17T23:56:24Z","modified":"2026-03-18T19:56:16Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:25:32.813864Z"}],"ghsa":[{"id":"GHSA-8h8q-6873-q5fj","title":"Next.js Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-05-11T14:50:27Z","modified":"2026-05-11T14:50:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-h25m-26qc-wcjf","title":"Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.","status":"published","published":"2026-01-28T15:38:01Z","modified":"2026-01-28T15:38:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T14:39:20.563096Z"},{"id":"GHSA-jcc7-9wpm-mj36","title":"Next.js: null origin can bypass dev HMR websocket CSRF checks","description":"## Summary\nIn `next dev`, cross-site protections for internal development endpoints could treat `Origin: null` as a bypass case even when [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins) is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.\n\n## Impact\nIf a developer visits attacker-controlled content while running an affected `next dev` server with [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins) configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.\n\nThis issue affects development mode only. It does not affect `next start`, and it does not expose internal debugging functionality to the network by default.\n\n## Patches\nFixed by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins on internal development endpoints.\n\n## Workarounds\nIf upgrade is not immediately possible:\n- Do not expose `next dev` to untrusted networks.\n- If you use [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins), reject requests and websocket upgrades with `Origin: null` for internal dev endpoints at your proxy.","status":"published","published":"2026-03-17T15:29:48Z","modified":"2026-03-25T18:51:20Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-1385"],"updated_at":"2026-11-02T14:39:41.724707Z"},{"id":"GHSA-q4gf-8mx6-v5v3","title":"Next.js has a Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-04-10T15:35:47Z","modified":"2026-04-10T15:35:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:52.102227Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2025-12-11T22:49:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497","CWE-502","CWE-1395"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2026-27977","description":"Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.","status":"published","published":"2026-03-18T00:16:19.947Z","modified":"2026-06-17T10:28:00.327Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1385"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-27977","title":"Next.js: null origin can bypass dev HMR websocket CSRF checks","description":"Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.","status":"published","published":"2026-03-17T23:56:24.631Z","modified":"2026-10-28T02:30:45.340213646Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-1385"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-8h8q-6873-q5fj","title":"Next.js Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-05-11T14:50:27Z","modified":"2026-09-10T03:51:04.979274056Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GHSA-h25m-26qc-wcjf","title":"Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.","status":"published","published":"2026-01-28T15:38:01Z","modified":"2026-09-10T03:50:33.105717591Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GHSA-jcc7-9wpm-mj36","title":"Next.js: null origin can bypass dev HMR websocket CSRF checks","description":"## Summary\nIn `next dev`, cross-site protections for internal development endpoints could treat `Origin: null` as a bypass case even when [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins) is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.\n\n## Impact\nIf a developer visits attacker-controlled content while running an affected `next dev` server with [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins) configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.\n\nThis issue affects development mode only. It does not affect `next start`, and it does not expose internal debugging functionality to the network by default.\n\n## Patches\nFixed by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins on internal development endpoints.\n\n## Workarounds\nIf upgrade is not immediately possible:\n- Do not expose `next dev` to untrusted networks.\n- If you use [`allowedDevOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins), reject requests and websocket upgrades with `Origin: null` for internal dev endpoints at your proxy.","status":"published","published":"2026-03-17T15:29:48Z","modified":"2026-03-25T19:49:01.129152Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-1385"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"GHSA-q4gf-8mx6-v5v3","title":"Next.js has a Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-04-10T15:35:47Z","modified":"2026-09-10T03:51:02.717818177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2026-09-10T03:50:32.139022825Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1395","CWE-497","CWE-502"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CLSA-2026-1786710099","title":"TuxCare security update for 22 packages (9 CVEs)","description":"TuxCare rebuilt 22 packages to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"withdrawn","published":"2026-08-14T12:21:39Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792195747","title":"TuxCare security update for create-next-app (9 CVEs)","description":"TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-17T00:09:05Z","modified":"2026-10-17T01:30:11.298912074Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196876","title":"TuxCare security update for @next/eslint-plugin-next (9 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-17T00:27:56Z","modified":"2026-10-17T01:30:11.75522355Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206291","title":"TuxCare security update for @next/bundle-analyzer (9 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-17T03:04:47Z","modified":"2026-10-17T07:00:39.981293019Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256965","title":"TuxCare security update for next-rspack (9 CVEs)","description":"TuxCare rebuilt next-rspack to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-17T17:09:23Z","modified":"2026-10-17T19:00:44.336690848Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272245","title":"TuxCare security update for @next/plugin-storybook (9 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-17T21:24:03Z","modified":"2026-10-18T01:30:36.597657907Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293015","title":"TuxCare security update for @next/polyfill-module (9 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T03:10:14Z","modified":"2026-10-18T07:15:02.811912662Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304740","title":"TuxCare security update for @next/polyfill-nomodule (9 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T06:25:39Z","modified":"2026-10-18T07:15:16.011691091Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326308","title":"TuxCare security update for @next/react-refresh-utils (9 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T12:25:04Z","modified":"2026-10-18T13:16:01.012211831Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338234","title":"TuxCare security update for @next/third-parties (9 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T15:43:50Z","modified":"2026-10-18T19:15:41.359118934Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346469","title":"TuxCare security update for @next/swc-linux-x64-gnu (9 CVEs)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T18:01:08Z","modified":"2026-10-18T19:16:07.414793637Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358598","title":"TuxCare security update for @next/codemod (9 CVEs)","description":"TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T21:23:16Z","modified":"2026-10-19T07:46:00.99305308Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364005","title":"TuxCare security update for @next/mdx (9 CVEs)","description":"TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T22:53:22Z","modified":"2026-10-19T07:46:06.590346219Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367390","title":"TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.","status":"published","published":"2026-10-18T23:49:49Z","modified":"2026-10-19T07:46:30.855402151Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"ROOT-APP-NPM-CVE-2026-27977","title":"CVE-2026-27977 in next - Patched by Root","description":"Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-17T08:47:42Z","modified":"2026-08-17T11:00:11.117345818Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-8h8q-6873-q5fj","title":"GHSA-8h8q-6873-q5fj in next - Patched by Root","description":"Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:05.820234548Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-h25m-26qc-wcjf","title":"GHSA-h25m-26qc-wcjf in next - Patched by Root","description":"Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:06.672348464Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3","title":"GHSA-q4gf-8mx6-v5v3 in next - Patched by Root","description":"Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:05.55154554Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}