43 matches found
CVE-2026-44581 Next.js: Cross-site scripting in App Router applications using CSP nonces
Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derive...
NPM: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
NPM: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes vulnerability discovered by ? in WordPress Npm next versions = 15.2.0, 15.5.16...
CVE-2026-23870: Imperva Customers Protected Against Critical React Server Components DoS Vulnerability
TL;DR:A newly disclosed denial-of-service vulnerability, CVE-2026-23870, impacts React Server Components and dependent frameworks, including Next.js App Router deployments. The flaw enables unauthenticated attackers to send specially crafted HTTP requests that trigger excessive CPU consumption...
GHSA-Q4GF-8MX6-V5V3 Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this...
CVE-2026-32887
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 RSC lab intentionally vulnerable Local Doc...
PT-2026-26681
Name of the Vulnerable Software and Affected Versions Effect versions prior to 3.20.0 @effect/rpc versions prior to 0.72.1 @effect/platform versions prior to 0.94.2 Description Effect is a TypeScript framework used for building TypeScript applications. A flaw exists in versions prior to 3.20.0,...
Exploit for Deserialization of Untrusted Data in Facebook React
CyberSec Blog CTF - React2Shell PoC Ce dépôt fournit un envir...
Exploit for Deserialization of Untrusted Data in Facebook React
React2Shell PoC This repository provides a minimal intentiona...
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Note that this vulnerability is only present when using experimentalcaller / experimentalnextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...
CVE-2025-68130
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...
EUVD-2025-203822
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...
Exploit for Deserialization of Untrusted Data in Facebook React
Next.Js React Server Components RSC Vulnerabilities This re...
GHSA-MWV6-3258-Q52C Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184. A malicious HTTP request can...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 - Next.js RSC Remote Code Execution Exploit...
Exploit for Deserialization of Untrusted Data in Facebook React
RSC Infra Scanner rscinfrascan.py is a fast, asynchronous...
Exploit for CVE-2025-55182
React2Shell – Critical Remote Code Execution in React Server C...
Exploit for CVE-2025-55182
React2Shell – Critical Remote Code Execution in React Server C...