CVE-2025-13984

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

EUVD-2025-206437

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

CVE-2025-13984

The Drupal Next.js module (specifically SA-CONTRIB-2025-122 ) contains a permissive cross-domain security policy that enables Cross-Origin Resource Sharing (CORS) with insecure default settings (Access-Control-Allow-Origin: ps *). This behavior overrides any services.yml CORS configuration, allow...

CVE-2025-13984 Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864. A specially crafted HTTP...

9remote (>=0.1.0, <=0.1.8), @acvtech5b9/vms-multi-language-locals (100.0.0) +119 more potentially affected by CVE-2026-23864 via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

9remote (>=0.1.0, <=0.1.8), @acvtech5b9/vms-multi-language-locals (100.0.0) +119 more potentially affected by unknown CVE via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

@vitnode/blog (>=1.2.0-canary.56, <=1.2.0-canary.59) potentially affected by CVE-2026-23864 via next (15.6.0-canary.41)

next NPM version 15.6.0-canary.41 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @vitnode/blog =1.2.0-canary.56, =1.2.0-canary.59 Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +205 more potentially affected by CVE-2026-23864 via next (>=16.0.0-beta.0, <=16.0.10)

next NPM version =16.0.0-beta.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4556 and more Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2026-23864 via next (>=15.2.0-canary.64, <=15.2.8)

next NPM version =15.2.0-canary.64, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2026-23864...

@vitnode/blog (>=1.2.0-canary.56, <=1.2.0-canary.59) potentially affected by CVE-2025-59472 via next (15.6.0-canary.41)

next NPM version 15.6.0-canary.41 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @vitnode/blog =1.2.0-canary.56, =1.2.0-canary.59 Source cves: CVE-2025-59472 Source advisory: GHSA-5F7Q-JPQC-WP7H...

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...

EUVD-2025-206333

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint...

next-era (>=3.0.2, <=4.1.0-canary.13) potentially affected by CVE-2025-59472 via next (15.3.0-canary.1)

next NPM version 15.3.0-canary.1 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - next-era =3.0.2, =4.1.0-canary.13 Source cves: CVE-2025-59472 Source advisory: OSV:GHSA-5F7Q-JPQC-WP7H...

@risc0/ui (>=0.0.314, <=0.0.315) potentially affected by CVE-2025-59472 via next (15.2.2-canary.0)

next NPM version 15.2.2-canary.0 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @risc0/ui =0.0.314, =0.0.315 Source cves: CVE-2025-59472 Source advisory: OSV:GHSA-5F7Q-JPQC-WP7H...

@optodev/ui (>=1.1.0, <=1.1.1), intersightai-db-frontend (0.1.0) potentially affected by CVE-2025-59472 via next (>=15.2.0-canary.64, <=15.2.0-canary.75)

next NPM version =15.2.0-canary.64, =1.1.0, =1.1.1 - intersightai-db-frontend 0.1.0 Source cves: CVE-2025-59472 Source advisory: OSV:GHSA-5F7Q-JPQC-WP7H...

@vitnode/blog (>=1.2.0-canary.56, <=1.2.0-canary.59) potentially affected by CVE-2025-59472 via next (15.6.0-canary.41)

next NPM version 15.6.0-canary.41 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @vitnode/blog =1.2.0-canary.56, =1.2.0-canary.59 Source cves: CVE-2025-59472 Source advisory: OSV:GHSA-5F7Q-JPQC-WP7H...

@lightdotso/ai (>=0.0.1, <=0.0.18), @lightdotso/app (>=3.2.7, <=3.2.23) +35 more potentially affected by CVE-2025-59472 via next (>=15.0.0-canary.2, <=15.0.0-canary.196)

next NPM version =15.0.0-canary.2, =0.0.1, =3.2.7, =0.0.2, =3.1.4, =0.0.2, =3.1.7, =0.0.7, =3.2.7, =3.1.6, =3.0.7, =0.0.2, =0.0.7, =0.0.6, =3.1.4, =0.0.8, =0.0.21 and more Source cves: CVE-2025-59472 Source advisory: GHSA-5F7Q-JPQC-WP7H...

PT-2026-5203

Name of the Vulnerable Software and Affected Versions Next.Js versions 0.0.0 through 1.6.3 Next.Js versions 2.0.0 through 2.0.0 Description A security issue exists in Next.Js related to a permissive cross-domain security policy with untrusted domains, which can lead to Cross-Site Scripting XSS...

Linux Distros Unpatched Vulnerability : CVE-2025-59471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization...