{"id":"CVE-2026-94484","aliases":["CLSA-2026-1791684070","CLSA-2026-1791685051","CLSA-2026-1791686070","CLSA-2026-1791901908","CLSA-2026-1791972524","CLSA-2026-1791978826","CLSA-2026-1792195722","CLSA-2026-1792195723","CLSA-2026-1792195724","CLSA-2026-1792195752","CLSA-2026-1792195757","CLSA-2026-1792196715","CLSA-2026-1792196716","CLSA-2026-1792196717","CLSA-2026-1792196732","CLSA-2026-1792196897","CLSA-2026-1792206283","CLSA-2026-1792206284","CLSA-2026-1792206285","CLSA-2026-1792206293","CLSA-2026-1792206332","CLSA-2026-1792256960","CLSA-2026-1792256961","CLSA-2026-1792256962","CLSA-2026-1792256968","CLSA-2026-1792256970","CLSA-2026-1792272220","CLSA-2026-1792272221","CLSA-2026-1792272222","CLSA-2026-1792272234","CLSA-2026-1792272254","CLSA-2026-1792292993","CLSA-2026-1792292994","CLSA-2026-1792292995","CLSA-2026-1792293004","CLSA-2026-1792293005","CLSA-2026-1792304709","CLSA-2026-1792304710","CLSA-2026-1792304711","CLSA-2026-1792304725","CLSA-2026-1792304748","CLSA-2026-1792326288","CLSA-2026-1792326289","CLSA-2026-1792326290","CLSA-2026-1792326298","CLSA-2026-1792326307","CLSA-2026-1792338227","CLSA-2026-1792338228","CLSA-2026-1792338231","CLSA-2026-1792338247","CLSA-2026-1792338248","CLSA-2026-1792346464","CLSA-2026-1792346465","CLSA-2026-1792346466","CLSA-2026-1792346473","CLSA-2026-1792346474","CLSA-2026-1792346492","CLSA-2026-1792358581","CLSA-2026-1792358582","CLSA-2026-1792358583","CLSA-2026-1792358590","CLSA-2026-1792358591","CLSA-2026-1792363977","CLSA-2026-1792363979","CLSA-2026-1792363980","CLSA-2026-1792363991","CLSA-2026-1792364008","CLSA-2026-1792367383","CLSA-2026-1792367384","CLSA-2026-1792367386","CLSA-2026-1792367395","CLSA-2026-1792367398","CLSA-2026-1792367407","EUVD-2026-91674","GHSA-mcj8-r9mp-w47p","GHSA-mwv6-3258-q52c","GHSA-w37m-7fhw-fmv9","ROOT-APP-NPM-CVE-2026-94484","ROOT-APP-NPM-GHSA-mwv6-3258-q52c"],"status":"published","title":"Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00244,"percentile":0.15762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-400","CWE-497","CWE-502","CWE-524"],"published":"2025-12-11T22:49:27Z","modified":"2026-11-02T12:15:04Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["16.3.8","15.5.27","14.2.34","15.0.6","15.1.10","15.2.7","15.3.7","15.4.9","15.5.8","15.6.0-canary.59","16.0.9","16.1.0-canary.17"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"next","fixed_in":["15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"create-next-app","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"next-rspack","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-module","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/third-parties","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/codemod","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/mdx","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","fixed_in":["15.5.26-tuxcare.2","15.5.25-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["15.5.27-aikido.1","16.3.8-aikido.1","15.5.27-aikido.2","14.2.33-aikido.2","14.2.32-aikido.4","14.2.30-aikido.7","14.2.26-aikido.6","14.2.26-aikido.4","14.2.30-aikido.10","13.4.19-aikido.6","13.4.19-aikido.7","14.2.10-aikido.3","14.2.13-aikido.3","14.2.3-aikido.1","14.2.15-aikido.4","14.0.4-aikido.9","14.1.3-aikido.2","14.2.25-aikido.2","14.1.0-aikido.4","14.2.18-aikido.2","13.3.0-aikido.5","14.2.15-aikido.3","13.4.19-aikido.3","14.1.0-aikido.7","14.1.0-aikido.8","14.2.13-aikido.1","14.2.3-aikido.5","14.2.0-aikido.2","14.0.3-aikido.3","14.2.5-aikido.9","14.2.5-aikido.10","14.2.2-aikido.7","14.2.33-aikido.1","14.1.3-aikido.5","14.2.29-aikido.1","14.2.29-aikido.5","14.2.31-aikido.2","14.2.18-aikido.1","14.0.0-aikido.7","14.2.10-aikido.4","14.2.13-aikido.4","14.2.10-aikido.2","14.2.18-aikido.6","14.2.21-aikido.6","14.2.16-aikido.6","14.2.25-aikido.1","14.2.0-aikido.6","14.2.31-aikido.5","14.2.0-aikido.5","14.2.2-aikido.9","14.2.30-aikido.8","14.2.24-aikido.7","14.0.3-aikido.6","14.2.32-aikido.5","14.2.33-aikido.3","14.0.0-aikido.5","14.2.3-aikido.3","13.5.4-aikido.5","14.1.3-aikido.6","13.3.0-aikido.6","14.0.3-aikido.4","14.2.13-aikido.2","14.2.21-aikido.4","14.0.0-aikido.3","14.1.4-aikido.7","14.2.21-aikido.2","13.3.0-aikido.2","14.2.16-aikido.2","14.2.16-aikido.4","13.5.4-aikido.2","13.3.0-aikido.7","14.2.33-aikido.4","14.2.26-aikido.3","14.0.3-aikido.5","14.2.30-aikido.9","14.1.4-aikido.8","14.2.32-aikido.6","13.5.4-aikido.6","14.1.3-aikido.7","14.2.16-aikido.5","14.0.0-aikido.6","14.2.21-aikido.5","14.2.3-aikido.4","14.2.2-aikido.8","13.4.19-aikido.4","14.2.15-aikido.5","14.2.3-aikido.2","13.5.6-aikido.4","14.2.28-aikido.5","14.2.32-aikido.2","14.1.4-aikido.9","14.1.3-aikido.1","13.3.0-aikido.3","14.2.32-aikido.7","13.5.6-aikido.5","14.2.15-aikido.6","14.1.3-aikido.8","14.2.32-aikido.8","14.2.29-aikido.4","14.2.28-aikido.1","14.2.33-aikido.5","13.5.6-aikido.6","14.2.26-aikido.5","14.2.28-aikido.2","14.2.26-aikido.2","14.0.4-aikido.8","14.2.28-aikido.3","14.1.0-aikido.2","14.2.31-aikido.3","14.2.24-aikido.6","14.1.4-aikido.6","14.2.18-aikido.3","13.3.0-aikido.4","14.1.0-aikido.5","14.2.16-aikido.3","14.0.0-aikido.4","14.1.0-aikido.3","14.2.18-aikido.4","13.5.4-aikido.3","14.2.31-aikido.1","14.2.0-aikido.3","13.4.19-aikido.5","14.2.31-aikido.4","14.2.29-aikido.2","14.2.0-aikido.1","13.5.4-aikido.4","14.2.21-aikido.1","14.2.16-aikido.1","14.1.3-aikido.3","13.3.0-aikido.8","14.2.21-aikido.3","14.2.32-aikido.3","14.2.29-aikido.3","13.5.11-aikido.9","14.1.3-aikido.4","14.2.0-aikido.4","14.2.30-aikido.6","14.2.28-aikido.4","14.2.33-aikido.6","14.1.0-aikido.6","14.2.18-aikido.5","13.5.6-aikido.7"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["15.5.27-root.io.1","16.3.8-root.io.1","15.5.27-root.io.2","14.2.33-root.io.2","14.2.32-root.io.4","14.2.30-root.io.7","14.2.26-root.io.6","14.2.26-root.io.4","14.2.30-root.io.10","13.4.19-root.io.6","13.4.19-root.io.7","14.2.10-root.io.3","14.2.13-root.io.3","14.2.3-root.io.1","14.2.15-root.io.4","14.0.4-root.io.9","14.1.3-root.io.2","14.2.25-root.io.2","14.1.0-root.io.4","14.2.18-root.io.2","13.3.0-root.io.5","14.2.15-root.io.3","13.4.19-root.io.3","14.1.0-root.io.7","14.1.0-root.io.8","14.2.13-root.io.1","14.2.3-root.io.5","14.2.0-root.io.2","14.0.3-root.io.3","14.2.5-root.io.9","14.2.5-root.io.10","14.2.2-root.io.7","14.2.33-root.io.1","14.1.3-root.io.5","14.2.29-root.io.1","14.2.29-root.io.5","14.2.31-root.io.2","14.2.18-root.io.1","14.0.0-root.io.7","14.2.10-root.io.4","14.2.13-root.io.4","14.2.10-root.io.2","14.2.18-root.io.6","14.2.21-root.io.6","14.2.16-root.io.6","14.2.25-root.io.1","14.2.0-root.io.6","14.2.31-root.io.5","14.2.0-root.io.5","14.2.2-root.io.9","14.2.30-root.io.8","14.2.24-root.io.7","14.0.3-root.io.6","14.2.32-root.io.5","14.2.33-root.io.3","14.0.0-root.io.5","14.2.3-root.io.3","13.5.4-root.io.5","14.1.3-root.io.6","13.3.0-root.io.6","14.0.3-root.io.4","14.2.13-root.io.2","14.2.21-root.io.4","14.0.0-root.io.3","14.1.4-root.io.7","14.2.21-root.io.2","13.3.0-root.io.2","14.2.16-root.io.2","14.2.16-root.io.4","13.5.4-root.io.2","13.3.0-root.io.7","14.2.33-root.io.4","14.2.26-root.io.3","14.0.3-root.io.5","14.2.30-root.io.9","14.1.4-root.io.8","14.2.32-root.io.6","13.5.4-root.io.6","14.1.3-root.io.7","14.2.16-root.io.5","14.0.0-root.io.6","14.2.21-root.io.5","14.2.3-root.io.4","14.2.2-root.io.8","13.4.19-root.io.4","14.2.15-root.io.5","14.2.3-root.io.2","13.5.6-root.io.4","14.2.28-root.io.5","14.2.32-root.io.2","14.1.4-root.io.9","14.1.3-root.io.1","13.3.0-root.io.3","14.2.32-root.io.7","13.5.6-root.io.5","14.2.15-root.io.6","14.1.3-root.io.8","14.2.32-root.io.8","14.2.29-root.io.4","14.2.28-root.io.1","14.2.33-root.io.5","13.5.6-root.io.6","14.2.26-root.io.5","14.2.28-root.io.2","14.2.26-root.io.2","14.0.4-root.io.8","14.2.28-root.io.3","14.2.24-root.io.6","14.1.0-root.io.2","14.2.31-root.io.3","14.1.4-root.io.6","14.2.18-root.io.3","13.3.0-root.io.4","14.1.0-root.io.5","14.2.16-root.io.3","14.0.0-root.io.4","14.1.0-root.io.3","14.2.18-root.io.4","13.5.4-root.io.3","14.2.31-root.io.1","14.2.0-root.io.3","13.4.19-root.io.5","14.2.31-root.io.4","14.2.29-root.io.2","14.2.0-root.io.1","13.5.4-root.io.4","14.2.21-root.io.1","14.1.3-root.io.3","14.2.16-root.io.1","13.3.0-root.io.8","14.2.21-root.io.3","14.2.32-root.io.3","14.2.29-root.io.3","13.5.11-root.io.9","14.1.3-root.io.4","14.2.0-root.io.4","14.2.30-root.io.6","14.2.33-root.io.6","14.2.28-root.io.4","14.1.0-root.io.6","13.5.6-root.io.7","14.2.18-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.5.27"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"14.2.34"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.1","16.0.6-tuxcare.10","16.0.6-tuxcare.11","16.0.6-tuxcare.12","16.0.6-tuxcare.2","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.3"}]}],"versions":["15.1.2","15.1.2-tuxcare.1","15.1.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.2"}]}],"versions":["15.5.24","15.5.24-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.2"}]}],"versions":["15.5.26","15.5.26-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.2"}]}],"versions":["15.5.23","15.5.23-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.3"}]}],"versions":["15.1.2","15.1.2-tuxcare.1","15.1.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.3"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"15.5.27"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.3.0"},{"fixed":"14.2.34"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.27-aikido.1"},{"fixed":"16.3.8-aikido.1"},{"fixed":"15.5.27-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.27-root.io.1"},{"fixed":"16.3.8-root.io.1"},{"fixed":"15.5.27-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.2.3-aikido.1"},{"fixed":"14.2.15-aikido.4"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.2.15-aikido.3"},{"fixed":"13.4.19-aikido.3"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.2.18-aikido.1"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.10-aikido.2"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.2.25-aikido.1"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"14.2.24-aikido.7"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.3-aikido.3"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.1.3-aikido.6"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"13.3.0-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.32-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"13.5.6-aikido.4"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"14.1.3-aikido.1"},{"fixed":"13.3.0-aikido.3"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"14.1.3-aikido.8"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.28-aikido.1"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"14.2.26-aikido.5"},{"fixed":"14.2.28-aikido.2"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.1.0-aikido.2"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.2.24-aikido.6"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.1.0-aikido.3"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.31-aikido.1"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"14.2.0-aikido.1"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"14.2.16-aikido.1"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"14.2.21-aikido.3"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.2.3-root.io.1"},{"fixed":"14.2.15-root.io.4"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.2.15-root.io.3"},{"fixed":"13.4.19-root.io.3"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.2.18-root.io.1"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.10-root.io.2"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.2.25-root.io.1"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"14.2.24-root.io.7"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.1.3-root.io.6"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"13.3.0-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.32-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"13.5.6-root.io.4"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"14.1.3-root.io.1"},{"fixed":"13.3.0-root.io.3"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.28-root.io.1"},{"fixed":"14.2.33-root.io.5"},{"fixed":"13.5.6-root.io.6"},{"fixed":"14.2.26-root.io.5"},{"fixed":"14.2.28-root.io.2"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.24-root.io.6"},{"fixed":"14.1.0-root.io.2"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.1.0-root.io.3"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.31-root.io.1"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.2.31-root.io.4"},{"fixed":"14.2.29-root.io.2"},{"fixed":"14.2.0-root.io.1"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"14.2.16-root.io.1"},{"fixed":"13.3.0-root.io.8"},{"fixed":"14.2.21-root.io.3"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"13.5.6-root.io.7"},{"fixed":"14.2.18-root.io.5"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94484","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mcj8-r9mp-w47p"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c","tags":["web"]},{"url":"https://nextjs.org/blog/security-update-2025-12-11","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55184","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mwv6-3258-q52c"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55183","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w37m-7fhw-fmv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94484.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-94484","title":"Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","status":"published","published":"2026-10-02T15:26:48.417Z","modified":"2026-10-05T20:07:39.105Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-91674","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","status":"published","published":"2026-10-02T15:26:48Z","modified":"2026-10-05T20:07:39Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-mcj8-r9mp-w47p","title":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","description":"Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.","status":"published","published":"2026-10-07T20:31:13Z","modified":"2026-10-07T20:31:15Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:41:29.107536Z"},{"id":"GHSA-mwv6-3258-q52c","title":"Next Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.","status":"published","published":"2025-12-11T22:49:27Z","modified":"2025-12-11T22:49:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502","CWE-1395"],"updated_at":"2026-11-02T14:39:13.204325Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2025-12-11T22:49:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497","CWE-502","CWE-1395"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2026-94484","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","status":"published","published":"2026-10-02T16:16:51.627Z","modified":"2026-10-05T20:17:28.907Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-94484","title":"Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","status":"published","published":"2026-10-02T15:26:48.417Z","modified":"2026-10-28T02:59:04.420200462Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-mcj8-r9mp-w47p","title":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","description":"Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.","status":"published","published":"2026-10-07T20:31:13Z","modified":"2026-10-07T20:45:04.800999218Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"GHSA-mwv6-3258-q52c","title":"Next Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.","status":"published","published":"2025-12-11T22:49:27Z","modified":"2026-09-10T03:50:31.942194779Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1395","CWE-400","CWE-502"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2026-09-10T03:50:32.139022825Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1395","CWE-497","CWE-502"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CLSA-2026-1791684070","title":"TuxCare security update for 21 packages (2 CVEs)","description":"TuxCare rebuilt 21 packages to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"withdrawn","published":"2026-10-11T02:01:10Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791685051","title":"TuxCare security update for 21 packages (1 CVE)","description":"TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"withdrawn","published":"2026-10-11T02:17:31Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791686070","title":"TuxCare security update for 21 packages (2 CVEs)","description":"TuxCare rebuilt 21 packages to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"withdrawn","published":"2026-10-11T02:34:30Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791901908","title":"TuxCare security update for 9 packages (10 CVEs)","description":"TuxCare rebuilt 9 packages to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.","status":"withdrawn","published":"2026-10-13T14:31:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791972524","title":"TuxCare security update for next (1 CVE)","description":"TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-14T10:08:44Z","modified":"2026-10-30T19:45:12.985331431Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791978826","title":"TuxCare security update for next (5 CVEs)","description":"TuxCare rebuilt next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-14T11:53:46Z","modified":"2026-10-30T19:46:05.08088577Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792195722","title":"TuxCare security update for create-next-app (2 CVEs)","description":"TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-17T00:08:40Z","modified":"2026-10-17T01:30:07.41530679Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195723","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-17T00:08:40Z","modified":"2026-10-17T01:30:09.75112334Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195724","title":"TuxCare security update for create-next-app (2 CVEs)","description":"TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-17T00:08:41Z","modified":"2026-10-17T01:30:09.688688019Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195752","title":"TuxCare security update for create-next-app (5 CVEs)","description":"TuxCare rebuilt create-next-app to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:09:08Z","modified":"2026-10-17T01:30:09.592153925Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195757","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-17T00:09:14Z","modified":"2026-10-17T01:30:09.138265379Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196715","title":"TuxCare security update for @next/eslint-plugin-next (2 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-17T00:25:15Z","modified":"2026-10-17T01:30:08.650091992Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196716","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-17T00:25:16Z","modified":"2026-10-17T01:30:08.643475751Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196717","title":"TuxCare security update for @next/eslint-plugin-next (2 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-17T00:25:17Z","modified":"2026-10-17T01:30:08.644753502Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196732","title":"TuxCare security update for @next/eslint-plugin-next (5 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:25:28Z","modified":"2026-10-17T01:30:12.30896296Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196897","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-17T00:28:16Z","modified":"2026-10-17T01:30:12.704783481Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206283","title":"TuxCare security update for @next/bundle-analyzer (2 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-17T03:04:42Z","modified":"2026-10-17T07:00:35.123859537Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206284","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-17T03:04:43Z","modified":"2026-10-17T07:00:39.482947159Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206285","title":"TuxCare security update for @next/bundle-analyzer (2 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-17T03:04:44Z","modified":"2026-10-17T07:00:39.641558768Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206293","title":"TuxCare security update for @next/bundle-analyzer (5 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T03:04:49Z","modified":"2026-10-17T07:00:41.241278243Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206332","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-17T03:05:28Z","modified":"2026-10-17T07:00:41.189594635Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256960","title":"TuxCare security update for next-rspack (2 CVEs)","description":"TuxCare rebuilt next-rspack to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-17T17:09:18Z","modified":"2026-10-17T19:01:44.964042364Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256961","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-17T17:09:18Z","modified":"2026-10-17T19:01:45.411954809Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256962","title":"TuxCare security update for next-rspack (2 CVEs)","description":"TuxCare rebuilt next-rspack to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-17T17:09:18Z","modified":"2026-10-17T19:01:25.830762057Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256968","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-17T17:09:25Z","modified":"2026-10-17T19:01:45.477570869Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256970","title":"TuxCare security update for next-rspack (5 CVEs)","description":"TuxCare rebuilt next-rspack to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T17:09:29Z","modified":"2026-10-17T19:01:44.970221293Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272220","title":"TuxCare security update for @next/plugin-storybook (2 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-17T21:23:39Z","modified":"2026-10-18T01:30:34.191837814Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272221","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-17T21:23:40Z","modified":"2026-10-18T01:30:34.738016909Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272222","title":"TuxCare security update for @next/plugin-storybook (2 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-17T21:23:41Z","modified":"2026-10-18T01:30:33.789350835Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272234","title":"TuxCare security update for @next/plugin-storybook (5 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T21:23:50Z","modified":"2026-10-18T01:30:33.787096023Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272254","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-17T21:24:11Z","modified":"2026-10-18T01:30:41.060477921Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292993","title":"TuxCare security update for @next/polyfill-module (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-18T03:09:53Z","modified":"2026-10-18T07:15:09.785875105Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292994","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-18T03:09:53Z","modified":"2026-10-18T07:15:12.60156472Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292995","title":"TuxCare security update for @next/polyfill-module (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-18T03:09:54Z","modified":"2026-10-18T07:15:12.806808534Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293004","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-18T03:10:00Z","modified":"2026-10-18T07:15:10.993208019Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293005","title":"TuxCare security update for @next/polyfill-module (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T03:10:01Z","modified":"2026-10-18T07:15:09.799897994Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304709","title":"TuxCare security update for @next/polyfill-nomodule (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-18T06:25:09Z","modified":"2026-10-18T07:15:16.106499251Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304710","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-18T06:25:10Z","modified":"2026-10-18T07:15:08.885573921Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304711","title":"TuxCare security update for @next/polyfill-nomodule (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-18T06:25:11Z","modified":"2026-10-18T07:15:16.006561585Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304725","title":"TuxCare security update for @next/polyfill-nomodule (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T06:25:21Z","modified":"2026-10-18T07:15:16.00782956Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304748","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-18T06:25:47Z","modified":"2026-10-18T07:15:15.103256392Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326288","title":"TuxCare security update for @next/react-refresh-utils (2 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 15.5.24-tuxcare.2.","status":"published","published":"2026-10-18T12:24:47Z","modified":"2026-10-18T13:16:00.054799036Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326289","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.26-tuxcare.2.","status":"published","published":"2026-10-18T12:24:48Z","modified":"2026-10-18T13:16:00.062587339Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326290","title":"TuxCare security update for @next/react-refresh-utils (2 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 15.5.23-tuxcare.2.","status":"published","published":"2026-10-18T12:24:49Z","modified":"2026-10-18T13:16:01.018953842Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326298","title":"TuxCare security update for @next/react-refresh-utils (5 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T12:24:54Z","modified":"2026-10-18T13:15:59.504727516Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326307","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.25-tuxcare.3.","status":"published","published":"2026-10-18T12:25:03Z","modified":"2026-10-18T13:16:00.053541786Z","updated_at":"2026-11-02T15:43:52.545698Z"}]},"sources_more":{"osv":29}}