638 matches found
PT-2026-23032
Name of the Vulnerable Software and Affected Versions @opennextjs/cloudflare affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the @opennextjs/cloudflare package. This is due to a path normalization bypass in the /cdn-cgi/image/ handler. Specifically,...
📄 Next.js 15.2.3 Middleware Authorization Bypass
This Python script checks whether a website built with Next.js is vulnerable to CVE‑2025‑29927, a middleware authorization bypass flaw triggered by the request header:x-middleware-subrequest...
Exploit for CVE-2025-66478
Vulnerable Mall Next.js Red/Blue Team Training Target Vul...
9remote (>=0.1.0, <=0.1.8), @acvtech5b9/vms-multi-language-locals (>=100.0.0, <=101.0.0) +117 more potentially affected by unknown CVE via next (>=16.1.0, <=16.1.4)
next NPM version =16.1.0, =0.1.0, =100.0.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...
Drupal Next.js security vulnerabilities
Drupal Next.js is a module within the Drupal community that enables a deep integration between Drupal and Next.js. Versions of Drupal Next.js prior to 1.6.4 and 2.0.1 contained security vulnerabilities. These vulnerabilities were due to overly lax cross-domain security policies, which could lead ...
CVE-2025-59472
CVE-2025-59472 concerns Next.js with Partial Prerendering (PPR) enabled in minimal mode. The vulnerability stems from the PPR resume endpoint accepting unauthenticated POSTs (Next-Resume: 1) and processing attacker-controlled data, causing memory exhaustion via two vectors: 1) Unbounded request b...
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...
47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +208 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)
next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...
Exploit for Improper Authorization in Vercel Next.Js
PoC: CVE-2025-29927 - Next.js Middleware Bypass This reposito...
Exploit for Deserialization of Untrusted Data in Facebook React
React2Shell PoC This repository provides a minimal intentiona...
@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)
@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: GHSA-4XC5-WFWC-JW47...
@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)
@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: MEND:CVE-2025-65098...
OAuth Parameter Injection
Auth0 Next.js is vulnerable to OAuth Parameter Injection. The vulnerability is due to insufficient validation of the returnTo parameter, where attacker-controlled input can inject unintended OAuth query parameters into the authorization request, potentially resulting in tokens being issued with...
Exploit for Deserialization of Untrusted Data in Facebook React
Affected Versions |Component|Recommended Installation Version...
react2shell-poc-demo
!CAUTION THIS PROJECT IS USED FOR DEMONSTRATION PURPOSES O...
Exploit for Deserialization of Untrusted Data in Facebook React
🛠️ CVE-2025-55182-POC-NEXTJS - Simple Proof of Concept for Nex...
Exploit for Deserialization of Untrusted Data in Facebook React
Node.js RCE Mitigation: DevOps as the Last Line of Defense Th...
@storybook/angular (>=10.2.0-alpha.0, <=10.2.0-alpha.6), @storybook/ember (>=10.2.0-alpha.0, <=10.2.0-alpha.6) +3 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=10.2.0-alpha.0, <=10.2.0-alpha.6)
@storybook/builder-webpack5 NPM version =10.2.0-alpha.0, =10.2.0-alpha.0, =10.2.0-alpha.0, =10.2.0-alpha.0, =10.2.0-alpha.0, =10.2.0-alpha.0, =10.2.0-alpha.6 Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKBUILDERWEBPACK5-14470054...