{"id":"CVE-2026-94483","aliases":["CLSA-2026-1791978826","CLSA-2026-1792195752","CLSA-2026-1792196732","CLSA-2026-1792206293","CLSA-2026-1792256970","CLSA-2026-1792272234","CLSA-2026-1792293005","CLSA-2026-1792304725","CLSA-2026-1792326298","CLSA-2026-1792338248","CLSA-2026-1792346474","CLSA-2026-1792358591","CLSA-2026-1792363991","CLSA-2026-1792367398","EUVD-2026-91671","GHSA-cjq9-62q9-8jv4","ROOT-APP-NPM-CVE-2026-94483"],"status":"published","title":"Next.js: Server-Side Request Forgery in Image Optimization","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0033,"percentile":0.26312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-10-02T15:18:38Z","modified":"2026-10-30T19:46:05Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["16.3.8"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.3.3-aikido.2","16.3.6-aikido.1","16.3.3-aikido.3","16.3.3-aikido.4","16.3.6-aikido.2","16.3.8-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.3.3-root.io.2","16.3.6-root.io.1","16.3.3-root.io.3","16.3.3-root.io.4","16.3.6-root.io.2","16.3.8-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.1","16.0.6-tuxcare.10","16.0.6-tuxcare.11","16.0.6-tuxcare.12","16.0.6-tuxcare.2","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-aikido.2"},{"fixed":"16.3.6-aikido.1"},{"fixed":"16.3.3-aikido.3"},{"fixed":"16.3.3-aikido.4"},{"fixed":"16.3.6-aikido.2"},{"fixed":"16.3.8-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-root.io.2"},{"fixed":"16.3.6-root.io.1"},{"fixed":"16.3.3-root.io.3"},{"fixed":"16.3.3-root.io.4"},{"fixed":"16.3.6-root.io.2"},{"fixed":"16.3.8-root.io.1"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94483.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-94483","title":"Next.js: Server-Side Request Forgery in Image Optimization","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:18:38.684Z","modified":"2026-10-06T16:33:25.979Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-91671","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:18:38Z","modified":"2026-10-06T16:33:25Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:37.480805Z"}],"ghsa":[{"id":"GHSA-cjq9-62q9-8jv4","title":"Next.js has Server-Side Request Forgery in Image Optimization","description":"## Impact\n\nAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. \n\n## Workaround\n\nAudit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.","status":"published","published":"2026-10-07T20:30:55Z","modified":"2026-10-07T20:30:56Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2026-94483","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T16:16:51.473Z","modified":"2026-10-06T17:17:27.837Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-94483","title":"Next.js: Server-Side Request Forgery in Image Optimization","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:18:38.684Z","modified":"2026-10-28T03:01:42.803499384Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-cjq9-62q9-8jv4","title":"Next.js has Server-Side Request Forgery in Image Optimization","description":"## Impact\n\nAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. \n\n## Workaround\n\nAudit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.","status":"published","published":"2026-10-07T20:30:55Z","modified":"2026-10-07T20:45:06.190363835Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"CLSA-2026-1791978826","title":"TuxCare security update for next (5 CVEs)","description":"TuxCare rebuilt next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-14T11:53:46Z","modified":"2026-10-30T19:46:05.08088577Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792195752","title":"TuxCare security update for create-next-app (5 CVEs)","description":"TuxCare rebuilt create-next-app to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:09:08Z","modified":"2026-10-17T01:30:09.592153925Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196732","title":"TuxCare security update for @next/eslint-plugin-next (5 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:25:28Z","modified":"2026-10-17T01:30:12.30896296Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206293","title":"TuxCare security update for @next/bundle-analyzer (5 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T03:04:49Z","modified":"2026-10-17T07:00:41.241278243Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256970","title":"TuxCare security update for next-rspack (5 CVEs)","description":"TuxCare rebuilt next-rspack to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T17:09:29Z","modified":"2026-10-17T19:01:44.970221293Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272234","title":"TuxCare security update for @next/plugin-storybook (5 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T21:23:50Z","modified":"2026-10-18T01:30:33.787096023Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293005","title":"TuxCare security update for @next/polyfill-module (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T03:10:01Z","modified":"2026-10-18T07:15:09.799897994Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304725","title":"TuxCare security update for @next/polyfill-nomodule (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T06:25:21Z","modified":"2026-10-18T07:15:16.00782956Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326298","title":"TuxCare security update for @next/react-refresh-utils (5 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T12:24:54Z","modified":"2026-10-18T13:15:59.504727516Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338248","title":"TuxCare security update for @next/third-parties (5 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T15:44:06Z","modified":"2026-10-18T19:15:42.060989069Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346474","title":"TuxCare security update for @next/swc-linux-x64-gnu (5 CVEs)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T18:01:10Z","modified":"2026-10-18T19:16:07.804676711Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358591","title":"TuxCare security update for @next/codemod (5 CVEs)","description":"TuxCare rebuilt @next/codemod to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T21:23:07Z","modified":"2026-10-19T07:46:01.583868053Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792363991","title":"TuxCare security update for @next/mdx (5 CVEs)","description":"TuxCare rebuilt @next/mdx to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T22:53:08Z","modified":"2026-10-19T07:46:05.853184764Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367398","title":"TuxCare security update for @next/swc-linux-arm64-gnu (5 CVEs)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T23:49:54Z","modified":"2026-10-19T07:46:33.864152976Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"ROOT-APP-NPM-CVE-2026-94483","title":"CVE-2026-94483 in next - Patched by Root","description":"Root has patched CVE-2026-94483 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T13:03:23Z","modified":"2026-10-30T14:15:03.454712227Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}