next vulnerabilities (npm)
71 vulnerabilities.
-
nextnpm Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass 6.3 Medium -
nextnpm Next.js: Server-Side Request Forgery in Image Optimization 8.3 High -
nextnpm Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages 6.3 Medium -
nextnpm Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint 2.3 Low -
nextnpm next.js cache leak on warm `use cache` handlers accessing root param 6.3 Medium -
nextnpm Next.js: Denial of Service in App Router using Server Actions 8.2 High -
nextnpm Next.js: Denial of Service in the Image Optimization API using SVGs 6.3 Medium -
nextnpm Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale 8.3 High -
nextnpm Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 7.5 High -
nextnpm Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 7.5 High -
nextnpm Next.js: Middleware / Proxy bypass through dynamic route parameter injection 8.1 High -
nextnpm Next.js: Server-Side Request Forgery in Server Actions on Custom Servers 8.3 High -
nextnpm Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies 6.3 Medium -
nextnpm Next.js: Unbounded Server Action payload in Edge runtime 6.3 Medium -
nextnpm Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname 8.3 High -
nextnpm Next.js: Unauthenticated Disclosure of Internal Server Function endpoints 6.3 Medium -
nextnpm Next.js: Cross-site scripting in App Router applications using CSP nonces 4.7 Medium -
nextnpm Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input 6.1 Medium -
nextnpm Next.js: Denial of Service via connection exhaustion in applications using Cache Components 7.5 High -
nextnpm Next.js: Server-side request forgery in applications using WebSocket upgrades 8.6 High -
nextnpm Next.js: Denial of Service in the Image Optimization API 5.9 Medium -
nextnpm Next.js: Cache poisoning in React Server Component responses 5.4 Medium -
nextnpm Next.js: Middleware / Proxy bypass in Pages Router applications using i18n 7.5 High -
nextnpm Next.js: Middleware / Proxy redirects can be cache-poisoned 3.7 Low -
nextnpm Next.js: HTTP request smuggling in rewrites 6.3 Medium -
nextnpm Next.js: Unbounded next/image disk cache growth can exhaust storage 6.9 Medium -
nextnpm Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components 7.5 High -
nextnpm React Server Components have multiple Denial of Service Vulnerabilities 7.5 High -
nextnpm Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up 7.5 High -
nextnpm Next.js: Unbounded postponed resume buffering can lead to DoS 6.9 Medium -
nextnpm Next.js: null origin can bypass Server Actions CSRF checks 5.3 Medium -
nextnpm Next.js: null origin can bypass dev HMR websocket CSRF checks 2.3 Low -
nextnpm Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 5.9 Medium -
nextnpm Next.js Vulnerable to Denial of Service with Server Components 5.9 Medium -
nextnpm Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications 6.3 Medium -
nextnpm Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service 6.3 Medium -
nextnpm Next.js: Unauthenticated Remote Code Execution on windows-hosted servers 9.0 Critical -
nextnpm Next.js: Response Body Cache Confusion for Requests Containing Bodies 6.0 Medium -
nextnpm Next.js: Denial of Service in App Router using Server Actions 8.2 High -
nextnpm Next.js: Cache poisoning via collisions in React Server Component cache-busting 3.7 Low -
nextnpm Denial of Service Vulnerability in React Server Components 7.5 High -
nextnpm Next.js is vulnerable to RCE in React flight protocol 10.0 Critical -
nextnpm Next.js Affected by Cache Key Confusion for Image Optimization API Routes 6.2 Medium -
nextnpm Next.js Content Injection Vulnerability for Image Optimization 4.3 Medium -
nextnpm Next.js Improper Middleware Redirect Handling Leads to SSRF 6.5 Medium -
nextnpm Next.js DoS vulnerability via cache poisoning 7.5 High -
nextnpm Next.js cache poisoning due to omission of Vary header 3.7 Low -
nextnpm Information exposure in Next.js dev server due to lack of origin verification 2.3 Low -
nextnpm Next.js Race Condition to Cache Poisoning 3.7 Low -
nextnpm Next.js may leak x-middleware-subrequest-id to external hosts 1.7 Low - Show olderLoading…