Next.js Framework 13.x < 15.5.21 / 16.x < 16.2.11 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342581);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2026-64646", "CVE-2026-64648");

  script_name(english:"Next.js Framework 13.x < 15.5.21 / 16.x < 16.2.11 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by multiple vulnerabilities:

  - A server-side fetch with a request body may return a cached response body from a different request to the
    same URL but different body. Confidential data in the POST's response body would then leak to unauthorized
    requests, though the request itself will not be deduped. This only applies to fetch calls with a request
    that has a different init than the one passed to fetch. Applications using Pages Router are not
    vulnerable. (CVE-2026-64648)

  - Requests targeting Next.js applications using App Router with at least one Server Action can lead to
    excessive memory consumption if that Server Action uses the Edge runtime. (CVE-2026-64646)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?044fa987");
  # https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1e76eb61");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 15.5.21 or 16.2.11 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64648");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version':'13.0.0', 'fixed_version':'15.5.21'},
  {'min_version':'16.0.0', 'fixed_version':'16.2.11'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);