CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

CVE-2026-64642

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

EUVD-2026-49382

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642

CVE-2026-64642 affects Next.js (16.0.0–16.2.10) where crafted requests to App Router apps built with Turbopack and a single locale entry in config.i18n.locales can bypass middleware or proxy authentication. Root cause: improper handling of authentication flow under specific App Router configurati...

CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

ROOT-APP-NPM-CVE-2026-55602 CVE-2026-55602 in @rootio/http-proxy-middleware - Patched by Root

Root has patched CVE-2026-55602 in the @rootio/http-proxy-middleware package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-55603 CVE-2026-55603 in @rootio/http-proxy-middleware - Patched by Root

Root has patched CVE-2026-55603 in the @rootio/http-proxy-middleware package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-32997 CVE-2025-32997 in @rootio/http-proxy-middleware - Patched by Root

Root has patched CVE-2025-32997 in the @rootio/http-proxy-middleware package for Root:npm. Multiple fixed versions available...

Next.js Framework 16.x < 16.2.11 Middleware Bypass

The Next.js Framework on the remote host is affected by an authentication bypass vulnerability: - Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. CVE-2026-64642 Note...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5069 Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber

Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber...

GO-2026-5777 Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi...

GO-2026-5774 Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi...

GHSA-R277-6W6Q-XMQW kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Summary ValidationHandler.Load in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security...

EUVD-2026-48523

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware() function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware middleware in the Django web application framework is related to improper handling of registrations. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this middleware...

laravel-threat-detection v1.3.1

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...