1825 matches found
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.2.11...
9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +974 more potentially affected by CVE-2026-64641 via next (>=16.0.0, <=16.2.10)
next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-64641 Source advisory:...
GHSA-M99W-X7HQ-7VFJ Next.js: Denial of Service in App Router using Server Actions
Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...
NPM: Next.js: Denial of Service in App Router using Server Actions
NPM: Next.js: Denial of Service in App Router using Server Actions vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...
Next.js: Denial of Service in App Router using Server Actions
Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same...
PT-2026-63556
Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of...
PT-2026-63558
Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router, Server Actions use server, or use cache endpoints may disclose these endpoints, bypassing authentication on the pages...
PT-2026-63557
Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router built with Turbopack and a single entry in config.i18n.locales are susceptible to authentication bypass. Specifically, crafted requests can circumvent middleware...
CVE-2026-47129
NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the "activateUser" and "deactivateUser" Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the "admin" role...
CVE-2026-47129: Missing Authorization
NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...
react2shell-poc
react2shell-poc Proof-of-concept exploit for CVE-2025-55182...
PT-2026-64868
Root has patched AIKIDO-2026-10755 in the @rootio/Next.js package for Root:npm. Multiple fixed versions available...
PT-2026-64867
Root has patched AIKIDO-2026-10754 in the @rootio/Next.js package for Root:npm. Multiple fixed versions available...
PT-2026-64866
Root has patched AIKIDO-2024-10173 in the @rootio/Next.js package for Root:npm. Multiple fixed versions available...
PT-2026-64869
Root has patched AIKIDO-2026-10756 in the @rootio/Next.js package for Root:npm. Multiple fixed versions available...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 Unsafe Deserialization - RCE React 19.0.0...