CVE-2025-48947 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for...

nextjs-auth0 安全漏洞

nextjs-auth0 is an Auth0 open source Next.js SDK for logging in using Auth0. A security vulnerability exists in nextjs-auth0 versions 4.0.1 through 4.6.0 and earlier, which stems from a missing Cache-Control header that could result in session cookies being cached by a CDN...

The vulnerability of the Next.js software platform for creating web applications lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to the transfer of the x-middleware-subrequest-id parameter to external hosts. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

MAL-2025-4425 Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

CVE-2025-32421 Next.js Race Condition to Cache Poisoning

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Thi...

Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

GHSA-PJR6-JX7R-J4R6 Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

nextjs-auth0 代码问题漏洞

nextjs-auth0 is an Auth0 open source Next.js SDK for logging in using Auth0. A code issue vulnerability exists in versions of nextjs-auth0 prior to 4.0.1 through 4.5.1, which stems from not setting an expiration time when generating JWE tokens...

Next.js Middleware 15.2.2 Authorization Bypass

Next.js Middleware authorization bypass proof of concept exploit. Versions affected include 13.0.0 through 13.5.8, 14.0.0 through 14.2.24, 15.0.0 through 15.2.2, and 11.1.4 through 12.3...

Exploit for CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass PoC Overview This...

The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform allows attackers to circumvent existing security restrictions.

The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by...

Malicious code in browser-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4a391b07d3a459e7dd200191edde3d936f11a865bcecc3ac54f1210b905ee6c Any computer that has this package installed or running should be considered...

Malicious code in lexical-esm-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808bb38341306bbd08d655abd9928c5cf279412658db15774579d78f195f5a39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

Malicious code in nextjs-app-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be3a353ab6fd3d56d1698543312d483fa52ee3aa1fbc09c0d9efbf8c6b99e33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12010 Malicious code in nextjs-app-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be3a353ab6fd3d56d1698543312d483fa52ee3aa1fbc09c0d9efbf8c6b99e33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Impact Refresh tokens are logged to the console when the disabled by default debug flag, is enabled. Patches Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2...

GHSA-5WMG-9CVH-QW25 @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Impact Refresh tokens are logged to the console when the disabled by default debug flag, is enabled. Patches Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2...

AuthKit Next.js Library 日志信息泄露漏洞

AuthKit Next.js Library is an open source Next.js AuthKit library for WorkOS. A logging information disclosure vulnerability exists in the AuthKit Next.js Library, where a refresh token is logged to the console when the "debug" flag is enabled, which is disabled by default...