{"id":"CVE-2026-27980","aliases":["CLSA-2026-1791807020","EUVD-2026-12694","GHSA-3x4c-7xq6-9pq8","GHSA-8h8q-6873-q5fj","GHSA-h25m-26qc-wcjf","GHSA-q4gf-8mx6-v5v3","ROOT-APP-NPM-CVE-2026-27980","ROOT-APP-NPM-GHSA-8h8q-6873-q5fj","ROOT-APP-NPM-GHSA-h25m-26qc-wcjf","ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3"],"status":"published","title":"Next.js: Unbounded next/image disk cache growth can exhaust storage","description":"Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00725,"percentile":0.54429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-502","CWE-770"],"published":"2026-01-28T15:38:01Z","modified":"2026-11-02T11:15:06Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["16.1.7","15.5.14","15.5.16","16.2.5","15.0.8","15.1.12","15.2.9","15.3.9","15.4.11","15.5.10","15.6.0-canary.61","16.0.11","16.1.5","15.5.15","16.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.1.6-aikido.4","16.1.6-aikido.5","16.1.6-aikido.6","16.1.6-aikido.7","16.1.6-aikido.8","16.1.7-aikido.1","16.1.7-aikido.2","16.1.7-aikido.3","14.2.5-aikido.5","14.2.5-aikido.8","14.2.35-aikido.9","14.2.30-aikido.7","14.2.26-aikido.6","14.2.26-aikido.4","14.2.30-aikido.10","13.4.19-aikido.6","13.4.19-aikido.7","14.2.10-aikido.3","14.2.13-aikido.3","14.0.4-aikido.6","14.2.3-aikido.1","14.0.4-aikido.9","14.2.24-aikido.2","14.2.25-aikido.2","14.1.0-aikido.4","14.2.18-aikido.2","13.3.0-aikido.5","14.0.4-aikido.5","14.0.4-aikido.7","14.0.4-aikido.2","14.1.0-aikido.7","14.1.0-aikido.8","14.0.4-aikido.3","14.2.13-aikido.1","14.2.3-aikido.5","14.2.0-aikido.2","14.0.3-aikido.3","14.2.5-aikido.9","14.2.5-aikido.10","14.2.2-aikido.7","14.2.10-aikido.1","14.2.29-aikido.5","14.2.31-aikido.2","14.2.18-aikido.1","14.0.0-aikido.7","14.2.10-aikido.4","14.2.13-aikido.4","14.2.10-aikido.2","14.2.18-aikido.6","14.2.21-aikido.6","14.2.16-aikido.6","14.1.4-aikido.5","14.2.25-aikido.1","13.2.4-aikido.3","14.2.0-aikido.6","14.0.4-aikido.4","14.2.31-aikido.5","14.2.0-aikido.5","14.2.2-aikido.9","14.2.30-aikido.8","13.1.6-aikido.1","13.2.4-aikido.4","14.0.3-aikido.6","14.0.0-aikido.5","14.2.5-aikido.2","14.2.5-aikido.3","14.2.3-aikido.3","13.5.11-aikido.7","13.5.4-aikido.5","14.2.5-aikido.4","13.3.0-aikido.6","14.2.30-aikido.3","14.0.3-aikido.4","14.2.13-aikido.2","14.2.5-aikido.6","14.2.21-aikido.4","14.0.0-aikido.3","14.1.4-aikido.7","14.2.21-aikido.2","14.2.16-aikido.2","14.2.16-aikido.4","13.5.4-aikido.2","14.2.30-aikido.4","13.2.4-aikido.5","13.3.0-aikido.7","14.2.26-aikido.3","14.0.3-aikido.5","14.2.30-aikido.9","15.5.10-aikido.4","14.1.4-aikido.8","13.5.4-aikido.6","14.2.16-aikido.5","14.0.0-aikido.6","14.2.21-aikido.5","14.2.5-aikido.7","14.2.3-aikido.4","14.2.2-aikido.8","13.4.19-aikido.4","14.2.15-aikido.5","14.2.30-aikido.5","14.2.3-aikido.2","15.5.10-aikido.5","14.2.28-aikido.5","14.1.4-aikido.9","13.2.4-aikido.2","13.5.6-aikido.5","14.2.15-aikido.6","15.5.15-aikido.2","14.1.3-aikido.8","13.2.4-aikido.7","14.2.32-aikido.8","14.2.29-aikido.4","14.2.33-aikido.5","13.5.6-aikido.6","13.5.11-aikido.8","14.2.26-aikido.5","15.5.10-aikido.6","14.2.26-aikido.2","14.0.4-aikido.8","14.2.28-aikido.3","14.2.31-aikido.3","14.1.4-aikido.6","14.2.18-aikido.3","13.3.0-aikido.4","14.1.0-aikido.5","14.2.16-aikido.3","14.0.0-aikido.4","14.1.0-aikido.3","13.5.11-aikido.6","14.2.18-aikido.4","13.5.4-aikido.3","14.2.31-aikido.1","14.1.4-aikido.3","14.2.0-aikido.3","13.4.19-aikido.5","15.5.15-aikido.3","14.2.31-aikido.4","14.1.4-aikido.4","13.5.4-aikido.4","15.5.15-aikido.4","13.3.0-aikido.8","13.1.6-aikido.2","14.2.21-aikido.3","13.2.4-aikido.6","13.5.11-aikido.9","14.2.0-aikido.4","14.2.30-aikido.6","14.2.28-aikido.4","14.2.33-aikido.6","14.1.0-aikido.6","15.5.10-aikido.3","14.2.18-aikido.5","13.5.6-aikido.7","14.2.35-aikido.10","14.2.35-aikido.11","16.2.5-aikido.1","16.2.5-aikido.3","16.2.5-aikido.2","14.2.33-aikido.2","14.2.32-aikido.4","14.2.15-aikido.4","14.1.3-aikido.2","14.2.15-aikido.3","14.2.32-aikido.1","14.2.33-aikido.1","14.1.3-aikido.5","14.2.29-aikido.1","14.2.32-aikido.5","14.2.33-aikido.3","14.2.2-aikido.5","14.2.2-aikido.6","14.2.30-aikido.1","14.2.30-aikido.2","14.1.3-aikido.6","14.2.35-aikido.5","14.2.33-aikido.4","14.2.35-aikido.3","14.2.32-aikido.6","14.2.35-aikido.6","14.1.3-aikido.7","14.2.32-aikido.2","14.2.32-aikido.7","14.2.28-aikido.1","14.2.35-aikido.2","14.2.28-aikido.2","14.2.35-aikido.7","14.0.0-aikido.2","14.2.29-aikido.2","14.2.21-aikido.1","14.2.16-aikido.1","14.1.3-aikido.3","14.2.32-aikido.3","14.2.29-aikido.3","14.1.3-aikido.4","14.2.35-aikido.8","14.2.35-aikido.4","14.2.35-aikido.1","13.4.19-aikido.2","13.4.19-aikido.3","14.2.24-aikido.7","14.2.24-aikido.4","14.2.2-aikido.4","14.0.0-aikido.1","13.3.0-aikido.1","13.4.19-aikido.1","13.5.11-aikido.4","14.0.3-aikido.1","13.5.6-aikido.1","13.5.4-aikido.1","13.3.0-aikido.2","13.5.6-aikido.2","14.2.24-aikido.5","13.5.6-aikido.3","13.5.6-aikido.4","14.2.24-aikido.1","14.1.3-aikido.1","13.3.0-aikido.3","14.2.24-aikido.6","13.5.11-aikido.5","14.2.24-aikido.3","14.0.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.1.6-root.io.1","16.1.6-root.io.2","16.1.6-root.io.3","16.1.6-root.io.4","16.1.6-root.io.5","16.1.6-root.io.6","16.1.6-root.io.7","16.1.6-root.io.8","16.1.7-root.io.1","16.1.7-root.io.2","16.1.7-root.io.3","14.2.5-root.io.5","14.2.5-root.io.8","14.2.35-root.io.9","14.2.30-root.io.7","14.2.26-root.io.6","14.2.26-root.io.4","14.2.30-root.io.10","13.4.19-root.io.6","13.4.19-root.io.7","14.2.10-root.io.3","14.2.13-root.io.3","14.0.4-root.io.6","14.2.3-root.io.1","14.0.4-root.io.9","14.2.25-root.io.2","14.2.24-root.io.2","14.1.0-root.io.4","14.2.18-root.io.2","13.3.0-root.io.5","14.0.4-root.io.5","14.0.4-root.io.7","14.0.4-root.io.2","14.1.0-root.io.7","14.1.0-root.io.8","14.0.4-root.io.3","14.2.13-root.io.1","14.2.3-root.io.5","14.2.0-root.io.2","14.0.3-root.io.3","14.2.5-root.io.9","14.2.5-root.io.10","14.2.2-root.io.7","14.2.10-root.io.1","14.2.29-root.io.5","14.2.31-root.io.2","14.2.18-root.io.1","14.0.0-root.io.7","14.2.10-root.io.4","14.2.13-root.io.4","14.2.10-root.io.2","14.2.18-root.io.6","14.2.21-root.io.6","14.2.16-root.io.6","14.1.4-root.io.5","14.2.25-root.io.1","13.2.4-root.io.3","14.2.0-root.io.6","14.0.4-root.io.4","14.2.31-root.io.5","14.2.0-root.io.5","14.2.2-root.io.9","14.2.30-root.io.8","13.1.6-root.io.1","13.2.4-root.io.4","14.0.3-root.io.6","14.0.0-root.io.5","14.2.5-root.io.2","14.2.5-root.io.3","15.5.15-root.io.1","14.2.3-root.io.3","13.5.4-root.io.5","13.5.11-root.io.7","14.2.5-root.io.4","13.3.0-root.io.6","14.2.30-root.io.3","14.0.3-root.io.4","14.2.13-root.io.2","14.2.5-root.io.6","14.2.21-root.io.4","14.0.0-root.io.3","14.1.4-root.io.7","14.2.21-root.io.2","14.2.16-root.io.2","14.2.16-root.io.4","13.5.4-root.io.2","14.2.30-root.io.4","13.2.4-root.io.5","13.3.0-root.io.7","14.2.26-root.io.3","14.0.3-root.io.5","14.2.30-root.io.9","15.5.10-root.io.4","14.1.4-root.io.8","13.5.4-root.io.6","14.2.16-root.io.5","14.0.0-root.io.6","14.2.21-root.io.5","14.2.5-root.io.7","14.2.3-root.io.4","14.2.2-root.io.8","13.4.19-root.io.4","14.2.15-root.io.5","14.2.30-root.io.5","14.2.3-root.io.2","15.5.10-root.io.5","14.2.28-root.io.5","14.1.4-root.io.9","13.2.4-root.io.2","13.5.6-root.io.5","14.2.15-root.io.6","13.2.4-root.io.7","15.5.15-root.io.2","14.1.3-root.io.8","14.2.32-root.io.8","14.2.29-root.io.4","14.2.33-root.io.5","13.5.6-root.io.6","13.5.11-root.io.8","14.2.26-root.io.5","15.5.10-root.io.6","14.2.26-root.io.2","14.0.4-root.io.8","14.2.28-root.io.3","14.2.31-root.io.3","14.1.4-root.io.6","14.2.18-root.io.3","13.3.0-root.io.4","14.1.0-root.io.5","14.2.16-root.io.3","14.0.0-root.io.4","14.1.0-root.io.3","13.5.11-root.io.6","14.2.18-root.io.4","13.5.4-root.io.3","14.2.31-root.io.1","14.1.4-root.io.3","14.2.0-root.io.3","13.4.19-root.io.5","14.2.31-root.io.4","15.5.15-root.io.3","14.1.4-root.io.4","13.5.4-root.io.4","15.5.15-root.io.4","13.3.0-root.io.8","13.1.6-root.io.2","14.2.21-root.io.3","13.2.4-root.io.6","13.5.11-root.io.9","14.2.0-root.io.4","14.2.30-root.io.6","14.2.33-root.io.6","14.2.28-root.io.4","14.1.0-root.io.6","15.5.10-root.io.3","13.5.6-root.io.7","14.2.18-root.io.5","14.2.35-root.io.10","14.2.35-root.io.11","16.2.5-root.io.1","16.2.5-root.io.3","16.2.5-root.io.2","14.2.33-root.io.2","14.2.32-root.io.4","14.2.15-root.io.4","14.1.3-root.io.2","14.2.15-root.io.3","14.2.32-root.io.1","14.2.33-root.io.1","14.1.3-root.io.5","14.2.29-root.io.1","14.2.32-root.io.5","14.2.33-root.io.3","14.2.2-root.io.5","14.2.2-root.io.6","14.2.30-root.io.1","14.2.30-root.io.2","14.1.3-root.io.6","14.2.35-root.io.5","14.2.33-root.io.4","14.2.35-root.io.3","14.2.32-root.io.6","14.2.35-root.io.6","14.1.3-root.io.7","14.2.32-root.io.2","14.2.32-root.io.7","14.2.28-root.io.1","14.2.35-root.io.2","14.2.28-root.io.2","14.2.35-root.io.7","14.0.0-root.io.2","14.2.29-root.io.2","14.2.21-root.io.1","14.1.3-root.io.3","14.2.16-root.io.1","14.2.32-root.io.3","14.2.29-root.io.3","14.1.3-root.io.4","14.2.35-root.io.8","14.2.35-root.io.4","14.2.35-root.io.1","13.4.19-root.io.2","13.4.19-root.io.3","14.2.24-root.io.7","14.2.24-root.io.4","14.2.2-root.io.4","14.0.0-root.io.1","13.3.0-root.io.1","13.4.19-root.io.1","13.5.11-root.io.4","14.0.3-root.io.1","13.5.6-root.io.1","13.5.4-root.io.1","13.3.0-root.io.2","13.5.6-root.io.2","14.2.24-root.io.5","13.5.6-root.io.3","13.5.6-root.io.4","14.2.24-root.io.1","14.1.3-root.io.1","13.3.0-root.io.3","14.2.24-root.io.6","13.5.11-root.io.5","14.2.24-root.io.3","14.0.3-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.1.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"15.5.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.5.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.12"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.61"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.5.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"15.5.14"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.16"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.12"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.11"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.61"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.11"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.5"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.15"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.2.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-aikido.4"},{"fixed":"16.1.6-aikido.5"},{"fixed":"16.1.6-aikido.6"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.6-aikido.8"},{"fixed":"16.1.7-aikido.1"},{"fixed":"16.1.7-aikido.2"},{"fixed":"16.1.7-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-root.io.1"},{"fixed":"16.1.6-root.io.2"},{"fixed":"16.1.6-root.io.3"},{"fixed":"16.1.6-root.io.4"},{"fixed":"16.1.6-root.io.5"},{"fixed":"16.1.6-root.io.6"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"16.1.7-root.io.1"},{"fixed":"16.1.7-root.io.2"},{"fixed":"16.1.7-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.5"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.2.3-aikido.1"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.0.4-aikido.2"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.0.4-aikido.3"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.10-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.2.18-aikido.1"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.10-aikido.2"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.1.4-aikido.5"},{"fixed":"14.2.25-aikido.1"},{"fixed":"13.2.4-aikido.3"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.0.4-aikido.4"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"13.2.4-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.5-aikido.2"},{"fixed":"14.2.5-aikido.3"},{"fixed":"14.2.3-aikido.3"},{"fixed":"13.5.11-aikido.7"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.2.5-aikido.4"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.2.30-aikido.3"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.5-aikido.6"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.2.4-aikido.5"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"15.5.10-aikido.4"},{"fixed":"14.1.4-aikido.8"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.5-aikido.7"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"15.5.10-aikido.5"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.1.4-aikido.9"},{"fixed":"13.2.4-aikido.2"},{"fixed":"16.1.6-aikido.4"},{"fixed":"16.1.7-aikido.1"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"16.1.6-aikido.5"},{"fixed":"15.5.15-aikido.2"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"16.1.7-aikido.2"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.1.0-aikido.3"},{"fixed":"13.5.11-aikido.6"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.31-aikido.1"},{"fixed":"14.1.4-aikido.3"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"15.5.15-aikido.3"},{"fixed":"16.1.6-aikido.6"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.1.4-aikido.4"},{"fixed":"13.5.4-aikido.4"},{"fixed":"15.5.15-aikido.4"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"13.2.4-aikido.6"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"15.5.10-aikido.3"},{"fixed":"16.1.6-aikido.8"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"16.2.5-aikido.1"},{"fixed":"16.2.5-aikido.3"},{"fixed":"16.2.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.5"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.2.3-root.io.1"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.0.4-root.io.5"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.0.4-root.io.2"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.0.4-root.io.3"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.10-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.2.18-root.io.1"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.10-root.io.2"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.1.4-root.io.5"},{"fixed":"14.2.25-root.io.1"},{"fixed":"13.2.4-root.io.3"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.0.4-root.io.4"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"13.2.4-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.5-root.io.2"},{"fixed":"14.2.5-root.io.3"},{"fixed":"15.5.15-root.io.1"},{"fixed":"16.1.6-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.5-root.io.4"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.2.30-root.io.3"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.5-root.io.6"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.2.4-root.io.5"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"15.5.10-root.io.4"},{"fixed":"14.1.4-root.io.8"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.5-root.io.7"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"15.5.10-root.io.5"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.1.4-root.io.9"},{"fixed":"13.2.4-root.io.2"},{"fixed":"16.1.6-root.io.4"},{"fixed":"16.1.7-root.io.1"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"16.1.6-root.io.5"},{"fixed":"13.2.4-root.io.7"},{"fixed":"15.5.15-root.io.2"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.33-root.io.5"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"16.1.7-root.io.2"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.1.0-root.io.3"},{"fixed":"13.5.11-root.io.6"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.31-root.io.1"},{"fixed":"14.1.4-root.io.3"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.2.31-root.io.4"},{"fixed":"15.5.15-root.io.3"},{"fixed":"16.1.6-root.io.6"},{"fixed":"14.1.4-root.io.4"},{"fixed":"13.5.4-root.io.4"},{"fixed":"15.5.15-root.io.4"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"13.3.0-root.io.8"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"13.2.4-root.io.6"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"15.5.10-root.io.3"},{"fixed":"13.5.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"16.2.5-root.io.1"},{"fixed":"16.2.5-root.io.3"},{"fixed":"16.2.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.5"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.2.15-aikido.4"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.2.15-aikido.3"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.0.4-aikido.2"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.0.4-aikido.3"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.32-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.1.4-aikido.5"},{"fixed":"14.2.25-aikido.1"},{"fixed":"13.2.4-aikido.3"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.0.4-aikido.4"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"13.2.4-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.5-aikido.3"},{"fixed":"14.2.3-aikido.3"},{"fixed":"14.2.2-aikido.5"},{"fixed":"13.5.11-aikido.7"},{"fixed":"14.2.2-aikido.6"},{"fixed":"14.2.30-aikido.1"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.2.30-aikido.2"},{"fixed":"14.1.3-aikido.6"},{"fixed":"14.2.5-aikido.4"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.2.30-aikido.3"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.5-aikido.6"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.35-aikido.5"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.2.4-aikido.5"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.35-aikido.3"},{"fixed":"14.2.32-aikido.6"},{"fixed":"14.2.35-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.5-aikido.7"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.28-aikido.1"},{"fixed":"14.2.35-aikido.2"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"14.2.28-aikido.2"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.35-aikido.7"},{"fixed":"14.2.18-aikido.3"},{"fixed":"14.1.0-aikido.5"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.0.0-aikido.2"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"14.2.16-aikido.1"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"13.2.4-aikido.6"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.35-aikido.8"},{"fixed":"14.2.35-aikido.4"},{"fixed":"14.2.35-aikido.1"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.10-aikido.4"},{"fixed":"15.5.10-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"15.5.10-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.5"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.2.15-root.io.4"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.2.15-root.io.3"},{"fixed":"14.0.4-root.io.5"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.0.4-root.io.2"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.0.4-root.io.3"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.32-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.1.4-root.io.5"},{"fixed":"14.2.25-root.io.1"},{"fixed":"13.2.4-root.io.3"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.0.4-root.io.4"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"13.2.4-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.5-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.2.2-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.2-root.io.6"},{"fixed":"14.2.30-root.io.1"},{"fixed":"14.2.30-root.io.2"},{"fixed":"14.1.3-root.io.6"},{"fixed":"14.2.5-root.io.4"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.2.30-root.io.3"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.5-root.io.6"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.35-root.io.5"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.2.4-root.io.5"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.35-root.io.3"},{"fixed":"14.2.32-root.io.6"},{"fixed":"14.2.35-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.5-root.io.7"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"13.2.4-root.io.7"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.28-root.io.1"},{"fixed":"14.2.33-root.io.5"},{"fixed":"14.2.35-root.io.2"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"14.2.28-root.io.2"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.2.35-root.io.7"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"14.1.0-root.io.5"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.0.0-root.io.2"},{"fixed":"14.2.31-root.io.4"},{"fixed":"14.2.29-root.io.2"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"14.2.16-root.io.1"},{"fixed":"13.3.0-root.io.8"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"13.2.4-root.io.6"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"14.2.35-root.io.8"},{"fixed":"14.2.35-root.io.4"},{"fixed":"13.5.6-root.io.7"},{"fixed":"14.2.35-root.io.1"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.10-root.io.4"},{"fixed":"15.5.10-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"15.5.10-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-aikido.8"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.35-aikido.9"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.0.4-aikido.6"},{"fixed":"14.0.4-aikido.9"},{"fixed":"13.4.19-aikido.2"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.24-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"13.3.0-aikido.5"},{"fixed":"13.4.19-aikido.3"},{"fixed":"14.0.4-aikido.5"},{"fixed":"14.0.4-aikido.7"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.2.32-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.2.25-aikido.1"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"13.1.6-aikido.1"},{"fixed":"14.2.24-aikido.7"},{"fixed":"14.2.24-aikido.4"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.3-aikido.3"},{"fixed":"14.2.2-aikido.4"},{"fixed":"14.2.2-aikido.5"},{"fixed":"13.5.11-aikido.7"},{"fixed":"14.2.2-aikido.6"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.0.0-aikido.1"},{"fixed":"14.1.3-aikido.6"},{"fixed":"13.3.0-aikido.1"},{"fixed":"13.3.0-aikido.6"},{"fixed":"13.4.19-aikido.1"},{"fixed":"14.0.3-aikido.4"},{"fixed":"13.5.11-aikido.4"},{"fixed":"14.0.3-aikido.1"},{"fixed":"14.2.21-aikido.4"},{"fixed":"13.5.6-aikido.1"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"13.5.4-aikido.1"},{"fixed":"14.2.21-aikido.2"},{"fixed":"13.3.0-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"14.2.35-aikido.5"},{"fixed":"13.5.6-aikido.2"},{"fixed":"14.2.30-aikido.4"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"15.5.10-aikido.4"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.35-aikido.3"},{"fixed":"14.2.32-aikido.6"},{"fixed":"14.2.35-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.2.24-aikido.5"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.30-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"13.5.6-aikido.3"},{"fixed":"13.5.6-aikido.4"},{"fixed":"15.5.10-aikido.5"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.24-aikido.1"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"16.1.6-aikido.4"},{"fixed":"14.1.3-aikido.1"},{"fixed":"16.1.7-aikido.1"},{"fixed":"13.3.0-aikido.3"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"16.1.6-aikido.5"},{"fixed":"14.1.3-aikido.8"},{"fixed":"13.2.4-aikido.7"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.35-aikido.2"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"13.5.11-aikido.8"},{"fixed":"14.2.26-aikido.5"},{"fixed":"15.5.10-aikido.6"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.2.24-aikido.6"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.35-aikido.7"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"16.1.7-aikido.2"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"13.5.11-aikido.5"},{"fixed":"14.1.0-aikido.3"},{"fixed":"13.5.11-aikido.6"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.0.0-aikido.2"},{"fixed":"16.1.6-aikido.6"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"14.2.24-aikido.3"},{"fixed":"13.1.6-aikido.2"},{"fixed":"14.2.21-aikido.3"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.0.3-aikido.2"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.35-aikido.8"},{"fixed":"14.2.35-aikido.4"},{"fixed":"15.5.10-aikido.3"},{"fixed":"16.1.6-aikido.8"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"},{"fixed":"14.2.35-aikido.10"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.15-aikido.2"},{"fixed":"15.5.15-aikido.3"},{"fixed":"15.5.15-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.5-root.io.8"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.35-root.io.9"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.0.4-root.io.6"},{"fixed":"14.0.4-root.io.9"},{"fixed":"13.4.19-root.io.2"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.2.24-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.0.4-root.io.5"},{"fixed":"13.4.19-root.io.3"},{"fixed":"14.0.4-root.io.7"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.2.32-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.2.25-root.io.1"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"13.1.6-root.io.1"},{"fixed":"14.2.24-root.io.7"},{"fixed":"14.2.24-root.io.4"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"16.1.6-root.io.1"},{"fixed":"16.1.6-root.io.2"},{"fixed":"16.1.6-root.io.3"},{"fixed":"14.2.3-root.io.3"},{"fixed":"14.2.2-root.io.4"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.2.2-root.io.5"},{"fixed":"13.5.11-root.io.7"},{"fixed":"14.2.2-root.io.6"},{"fixed":"14.0.0-root.io.1"},{"fixed":"14.1.3-root.io.6"},{"fixed":"13.3.0-root.io.1"},{"fixed":"13.3.0-root.io.6"},{"fixed":"13.4.19-root.io.1"},{"fixed":"14.0.3-root.io.4"},{"fixed":"13.5.11-root.io.4"},{"fixed":"14.0.3-root.io.1"},{"fixed":"14.2.21-root.io.4"},{"fixed":"13.5.6-root.io.1"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"13.5.4-root.io.1"},{"fixed":"14.2.21-root.io.2"},{"fixed":"13.3.0-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"14.2.35-root.io.5"},{"fixed":"13.5.6-root.io.2"},{"fixed":"14.2.30-root.io.4"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"15.5.10-root.io.4"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.35-root.io.3"},{"fixed":"14.2.32-root.io.6"},{"fixed":"14.2.35-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.2.24-root.io.5"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.30-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"13.5.6-root.io.3"},{"fixed":"13.5.6-root.io.4"},{"fixed":"15.5.10-root.io.5"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.24-root.io.1"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"16.1.6-root.io.4"},{"fixed":"14.1.3-root.io.1"},{"fixed":"16.1.7-root.io.1"},{"fixed":"13.3.0-root.io.3"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"16.1.6-root.io.5"},{"fixed":"13.2.4-root.io.7"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.33-root.io.5"},{"fixed":"14.2.35-root.io.2"},{"fixed":"13.5.6-root.io.6"},{"fixed":"13.5.11-root.io.8"},{"fixed":"14.2.26-root.io.5"},{"fixed":"15.5.10-root.io.6"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.24-root.io.6"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.2.35-root.io.7"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"16.1.7-root.io.2"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"13.5.11-root.io.5"},{"fixed":"14.1.0-root.io.3"},{"fixed":"13.5.11-root.io.6"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.0.0-root.io.2"},{"fixed":"14.2.31-root.io.4"},{"fixed":"16.1.6-root.io.6"},{"fixed":"14.2.29-root.io.2"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"13.3.0-root.io.8"},{"fixed":"14.2.24-root.io.3"},{"fixed":"13.1.6-root.io.2"},{"fixed":"14.2.21-root.io.3"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.0.3-root.io.2"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"14.2.35-root.io.8"},{"fixed":"14.2.35-root.io.4"},{"fixed":"15.5.10-root.io.3"},{"fixed":"13.5.6-root.io.7"},{"fixed":"16.1.6-root.io.8"},{"fixed":"14.2.18-root.io.5"},{"fixed":"14.2.35-root.io.10"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.15-root.io.1"},{"fixed":"15.5.15-root.io.2"},{"fixed":"15.5.15-root.io.3"},{"fixed":"15.5.15-root.io.4"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.1.7","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27980","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3x4c-7xq6-9pq8"},{"url":"https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh","tags":["web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj","tags":["web"]},{"url":"https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8h8q-6873-q5fj"},{"url":"https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg","tags":["web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23864","tags":["advisory"]},{"url":"https://vercel.com/changelog/summary-of-cve-2026-23864","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h25m-26qc-wcjf"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3","tags":["web"]},{"url":"https://vercel.com/changelog/summary-of-cve-2026-23869","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q4gf-8mx6-v5v3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27980.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27980","title":"Next.js: Unbounded next/image disk cache growth can exhaust storage","description":"Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).","status":"published","published":"2026-03-18T00:23:34.862Z","modified":"2026-03-18T19:50:12.877Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-12694","description":"Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).","status":"published","published":"2026-03-18T00:23:34Z","modified":"2026-03-18T19:50:12Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:32.813864Z"}],"ghsa":[{"id":"GHSA-3x4c-7xq6-9pq8","title":"Next.js: Unbounded next/image disk cache growth can exhaust storage","description":"## Summary\nThe default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.\n\n## Impact\nAn attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.\n\n## Patches\nFixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. \n\n## Workarounds\nIf upgrade is not immediately possible:\n- Periodically clean `.next/cache/images`.\n- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)","status":"published","published":"2026-03-17T16:17:06Z","modified":"2026-03-19T18:33:25Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:38.524712Z"},{"id":"GHSA-8h8q-6873-q5fj","title":"Next.js Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-05-11T14:50:27Z","modified":"2026-05-11T14:50:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-h25m-26qc-wcjf","title":"Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.","status":"published","published":"2026-01-28T15:38:01Z","modified":"2026-01-28T15:38:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T14:39:20.563096Z"},{"id":"GHSA-q4gf-8mx6-v5v3","title":"Next.js has a Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-04-10T15:35:47Z","modified":"2026-04-10T15:35:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:52.102227Z"}],"nvd":[{"id":"CVE-2026-27980","description":"Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).","status":"published","published":"2026-03-18T01:16:04.957Z","modified":"2026-06-17T10:28:00.7Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-27980","title":"Next.js: Unbounded next/image disk cache growth can exhaust storage","description":"Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).","status":"published","published":"2026-03-18T00:23:34.862Z","modified":"2026-11-11T10:31:06.573358571Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"GHSA-3x4c-7xq6-9pq8","title":"Next.js: Unbounded next/image disk cache growth can exhaust storage","description":"## Summary\nThe default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.\n\n## Impact\nAn attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.\n\n## Patches\nFixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. \n\n## Workarounds\nIf upgrade is not immediately possible:\n- Periodically clean `.next/cache/images`.\n- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)","status":"published","published":"2026-03-17T16:17:06Z","modified":"2026-09-10T03:50:36.950018769Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"GHSA-8h8q-6873-q5fj","title":"Next.js Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-05-11T14:50:27Z","modified":"2026-09-10T03:51:04.979274056Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GHSA-h25m-26qc-wcjf","title":"Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.","status":"published","published":"2026-01-28T15:38:01Z","modified":"2026-09-10T03:50:33.105717591Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GHSA-q4gf-8mx6-v5v3","title":"Next.js has a Denial of Service with Server Components","description":"A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.","status":"published","published":"2026-04-10T15:35:47Z","modified":"2026-09-10T03:51:02.717818177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"CLSA-2026-1791807020","title":"TuxCare security update for 9 packages (28 CVEs)","description":"TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.","status":"withdrawn","published":"2026-10-12T12:10:20Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"ROOT-APP-NPM-CVE-2026-27980","title":"CVE-2026-27980 in next - Patched by Root","description":"Root has patched CVE-2026-27980 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-17T08:47:42Z","modified":"2026-08-17T11:00:12.90393413Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-8h8q-6873-q5fj","title":"GHSA-8h8q-6873-q5fj in next - Patched by Root","description":"Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:05.820234548Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-h25m-26qc-wcjf","title":"GHSA-h25m-26qc-wcjf in next - Patched by Root","description":"Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:06.672348464Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3","title":"GHSA-q4gf-8mx6-v5v3 in next - Patched by Root","description":"Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:42:42Z","modified":"2026-11-02T11:15:05.55154554Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}