MAL-2025-27402 Malicious code in nextjs-default (npm)

The package nextjs-default was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-27406 Malicious code in nextjs-nconf-centauri-middleware (npm)

The package nextjs-nconf-centauri-middleware was found to contain malicious code...

MAL-2025-17200 Malicious code in cluster-nextjs-html-webpack-plugin-scripts (npm)

The package cluster-nextjs-html-webpack-plugin-scripts was found to contain malicious code...

MAL-2025-27401 Malicious code in nextjs-cosmos-spinner-auth0 (npm)

The package nextjs-cosmos-spinner-auth0 was found to contain malicious code...

MAL-2025-28485 Malicious code in orderly-js-sdk-nextjs-template (npm)

The package orderly-js-sdk-nextjs-template was found to contain malicious code...

MAL-2025-15235 Malicious code in axios-antimatter-nextjs-leda (npm)

The package axios-antimatter-nextjs-leda was found to contain malicious code...

MAL-2025-23302 Malicious code in io-nextjs-loopback-blitz (npm)

The package io-nextjs-loopback-blitz was found to contain malicious code...

Malicious code in webdriver-manager-plutology-nextjs-dynamo (npm)

The package webdriver-manager-plutology-nextjs-dynamo was found to contain malicious code...

Malicious code in nextjs-https-supertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a35ef56ef551d99479645b88944856a3b2453ce3fc35c72feea29d824f261d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5939 Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5938 Malicious code in nextjs-https-supertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a35ef56ef551d99479645b88944856a3b2453ce3fc35c72feea29d824f261d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@bentwnghk/chat (>=1.91.2, <=1.91.6), @lobehub/chat (>=1.49.5, <=1.49.12) +1 more potentially affected by CVE-2025-53548 via @clerk/nextjs (>=6.3.1, <=6.17.0)

@clerk/nextjs NPM version =6.3.1, =1.91.2, =1.49.5, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...

Next.js 环境问题漏洞

Next.js is a React framework open-sourced by Vercel. An environment issue vulnerability exists in Next.js versions prior to 15.3.0 through 15.3.3 and Vercel CLI versions 41.4.1 through 42.2.0, which stems from a cache contamination vulnerability that could result in the return of incorrect conten...

MAL-2025-5569 Malicious code in nextjs-babel-toastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c1eb6ce58e4dc8f8a418262d19e1e72e07fb2892e20e7b7d647ff5a352479ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextjs-babel-toastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c1eb6ce58e4dc8f8a418262d19e1e72e07fb2892e20e7b7d647ff5a352479ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextjs-insight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db00088e31ce8475190f64475d3a917f95185bbf176e0ac091fe160399ce6f92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4856 Malicious code in nextjs-insight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db00088e31ce8475190f64475d3a917f95185bbf176e0ac091fe160399ce6f92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-F3FG-MF2Q-FJ3F NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK,...

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK,...