MAL-2025-27407 Malicious code in nextjs-surya (npm)

The package nextjs-surya was found to contain malicious code...

MAL-2025-27401 Malicious code in nextjs-cosmos-spinner-auth0 (npm)

The package nextjs-cosmos-spinner-auth0 was found to contain malicious code...

Malicious code in nextjs-https-supertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a35ef56ef551d99479645b88944856a3b2453ce3fc35c72feea29d824f261d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5939 Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5938 Malicious code in nextjs-https-supertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a35ef56ef551d99479645b88944856a3b2453ce3fc35c72feea29d824f261d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@async-atharv/ipaship (>=1.2.1 <=1.2.2), @bentwnghk/chat (>=1.85.2 <=1.107.2) +94 more potentially affected by CVE-2025-53548 via @clerk/backend (>=2.0.0 <=2.33.5)

@clerk/backend NPM version =2.0.0, =1.2.1, =1.85.2, =0.0.1, =3.0.3, =0.1.0, =2.8.0-snapshot.v20250514155045, =1.5.0-snapshot.v20250514155045, =2.3.0, =6.20.0-snapshot.v20250514155045, =1.7.0, =1.5.0, =4.8.0, =0.16.0, =1.7.0-snapshot.v20250514155045, =1.0.4, =1.0.7 and more Source cves:...

Next.js 环境问题漏洞

Next.js is a React framework open-sourced by Vercel. An environment issue vulnerability exists in Next.js versions prior to 15.3.0 through 15.3.3 and Vercel CLI versions 41.4.1 through 42.2.0, which stems from a cache contamination vulnerability that could result in the return of incorrect conten...

Malicious code in nextjs-babel-toastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c1eb6ce58e4dc8f8a418262d19e1e72e07fb2892e20e7b7d647ff5a352479ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5569 Malicious code in nextjs-babel-toastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c1eb6ce58e4dc8f8a418262d19e1e72e07fb2892e20e7b7d647ff5a352479ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextjs-insight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db00088e31ce8475190f64475d3a917f95185bbf176e0ac091fe160399ce6f92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4856 Malicious code in nextjs-insight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db00088e31ce8475190f64475d3a917f95185bbf176e0ac091fe160399ce6f92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK,...

GHSA-F3FG-MF2Q-FJ3F NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK,...

CVE-2025-48947 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for...

nextjs-auth0 安全漏洞

nextjs-auth0 is an Auth0 open source Next.js SDK for logging in using Auth0. A security vulnerability exists in nextjs-auth0 versions 4.0.1 through 4.6.0 and earlier, which stems from a missing Cache-Control header that could result in session cookies being cached by a CDN...

The vulnerability of the Next.js software platform for creating web applications lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to the transfer of the x-middleware-subrequest-id parameter to external hosts. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

MAL-2025-4425 Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

CVE-2025-32421 Next.js Race Condition to Cache Poisoning

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Thi...