@netlify/plugin-nextjs (>=4.0.0 <=4.7.0), @netlify/plugin-nextjs-experimental (>=0.0.1 <=0.0.6-alpha-tracing.2) potentially affected by CVE-2022-39239 via @netlify/ipx (>=0.0.10 <=0.0.9)

@netlify/ipx NPM version =0.0.10, =4.0.0, =0.0.1, =0.0.6-alpha-tracing.2 Source cves: CVE-2022-39239 Source advisory: OSV:GHSA-9JJV-524M-JM98...

Malicious code in nextjs-accelerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83f7c878f8ea9669769fb79e5abde0f57cbaa8a482dd7cf6f723e57c2eaffbfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4833 Malicious code in nextjs-accelerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83f7c878f8ea9669769fb79e5abde0f57cbaa8a482dd7cf6f723e57c2eaffbfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polaris-example-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2595e5124f13a673e719f1a7d7cca31d1e323960f1ee483a240227463f01be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5397 Malicious code in polaris-example-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2595e5124f13a673e719f1a7d7cca31d1e323960f1ee483a240227463f01be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ZEIT Next.js 安全漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in ZEIT Next.js that stems from the product's UI not restricting the display of critical information. An attacker could cause information leakage by...

@perimetre/nextjs-auth (>=0.1.0 <=0.2.1), @zagrajmy/app (>=0.0.1 <=0.1.0-alpha.0) potentially affected by CVE-2021-43812 via @auth0/nextjs-auth0 (>=0.11.0 <=0.16.1)

@auth0/nextjs-auth0 NPM version =0.11.0, =0.1.0, =0.0.1, =0.1.0-alpha.0 Source cves: CVE-2021-43812 Source advisory: OSV:GHSA-2MQV-4J3R-VJVP...

Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

ALPINE-CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

@0soft/use-nextjs-page-loader (>=0.0.23 <=0.0.25), @aaiello/rimble-ui (>=0.0.1 <=0.14.3) +556 more potentially affected by CVE-2021-43803 via next (>=10.0.0 <=11.1.3-canary.46)

next NPM version =10.0.0, =0.0.23, =0.0.1, =0.1.0, =0.0.25, =0.0.1, =0.0.1, =0.0.13, =1.0.0, =2.0.0-bundle-perf-test.0, =0.0.2, =2.1.0-section-linker.0 and more Source cves: CVE-2021-43803 Source advisory: OSV:GHSA-25MP-G6FV-MQXX...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

@0soft/use-nextjs-page-loader (>=0.0.23 <=0.0.25), @aaiello/rimble-ui (>=0.0.1 <=0.14.3) +460 more potentially affected by CVE-2021-37699 via next (>=10.0.0 <=11.0.1)

next NPM version =10.0.0, =0.0.23, =0.0.1, =0.1.0, =0.0.25, =0.0.1, =0.0.1, =0.0.13, =1.0.0, =2.0.0-bundle-perf-test.0, =0.0.2, =3.0.0-bundle-perf-test.0, =3.1.0-section-linker.0 and more Source cves: CVE-2021-37699 Source advisory: OSV:GHSA-VXF5-WXWP-M7G9...

ZEIT Next.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

Reflected XSS from the callback handler's error query parameter

Overview Overview @auth0/nextjs-auth0 versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are...

@perimetre/nextjs-auth (>=0.1.0 <=0.2.1), @zagrajmy/app (>=0.0.1 <=0.1.0-alpha.0) potentially affected by CVE-2021-32702 via @auth0/nextjs-auth0 (>=0.11.0 <=0.16.1)

@auth0/nextjs-auth0 NPM version =0.11.0, =0.1.0, =0.0.1, =0.1.0-alpha.0 Source cves: CVE-2021-32702 Source advisory: OSV:GHSA-954C-JJX6-CXV7...

Cross site scripting

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Cross-site Scripting

nextjs-auth0 lacks HTML escaping for error messages...

ZEIT Next.js Input Validation Error Vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. An input validation error vulnerability exists in ZEIT Next.js. The vulnerability stems from a web system or product that does not properly validate input data. No detailed...