1824 matches found
K000163660: Next.js vulnerability GHSA-2xp9-vwfh-vxw4
Security Advisory Description A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled. GHSA-2xp9-vwfh-vxw4 Impact...
K000163659: Next.js vulnerability CVE-2026-75604
Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route...
R2SAE
R2SAE - React2Shell Auto-Exploit A Firefox extension for detecting and exploiting CVE-2025-55182 Prototype Pollution vulnerability in React Server Actions Features • Installation • Usage • Disclaimer ⚠️ Disclaimer This tool is for authorized security testing only. Unauthorized access to computer...
CVE-2025-66478-Research-Proof-of-Concept
CVE-2025-66478-Research-Proof-of-Concept Overview This repository contains research and a proof-of-concept implementation related to CVE-2025-66478, a vulnerability affecting certain Next.js / React Server Components configurations. The project was developed in a controlled laboratory environment...
react2shell-scanner
react2shell-scanner Uno strumento a riga di comando per rilevare CVE-2025-55182 e CVE-2025-66478 in applicazioni Next.js che utilizzano React Server Components. Per i dettagli tecnici sulla vulnerabilità e la metodologia di rilevamento, consulta il nostro post sul blog:...
react2shell-ultimate
React2Shell Ultimate Scanner v2.0 Scanner professionale per vulnerabilità RCE in Next.js RSC per CVE-2025-66478 🎯 Panoramica React2Shell Ultimate è uno scanner completo per vulnerabilità per CVE-2025-66478 — una vulnerabilità critica di Esecuzione Remota di Codice RCE che colpisce le applicazioni...
react2shell
React2Shell: RCE 0-day nei React Server Components CVE-2025-55182 React e CVE-2025-66478 Next.js Questo repository contiene codice exploit per test di sicurezza autorizzati e solo a scopo educativo. Vedi anche: Molti ricercatori hanno pubblicato analisi di questa vulnerabilità. Controlla la sezio...
nextssrf
╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...
fix-react2shell-next
fix-react2shell-next Un comando per risolvere CVE-2025-66478 React 2 Shell RCE nella tua app Next.js / React RSC. npx fix-react2shell-next Aggiornamenti di versione deterministici secondo gli advisory ufficiali. Cosa fa 1. Scansiona ricorsivamente tutti i file package.json gestisce monorepo 2...
EUVD-2026-91668
Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages...
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...
GHSA-3W37-WQ28-93X7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...
NPM: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
NPM: Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages vulnerability discovered by ? in WordPress Npm next versions = 16.3.0, 16.3.8...
EUVD-2026-91670
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications...
NPM: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
NPM: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...
GHSA-4JQV-MC3X-M676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...
Next.js has information disclosure in development server's Model Context Protocol endpoint
The Next.js development server next dev exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets...
NPM: Next.js has information disclosure in development server's Model Context Protocol endpoint
NPM: Next.js has information disclosure in development server's Model Context Protocol endpoint vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...