638 matches found
EUVD-2025-12633
Malicious code in bioql PyPI...
Malware in sha256-validation-nextjs
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in sha256-validation-nextjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3290610bb31bf5689be7241b664ae5eb52b47b834fff3e2597c5ab75d88c4bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-47521 Malicious code in sha256-validation-nextjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3290610bb31bf5689be7241b664ae5eb52b47b834fff3e2597c5ab75d88c4bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Exploit for Incorrect Authorization in Vercel Next.Js
CVE-2025-29927 Research and Safe Testing Framework This repos...
MAL-2025-43622 Malicious code in bioinformatics-quantum-apex-nextjs (npm)
The package bioinformatics-quantum-apex-nextjs was found to contain malicious code...
MAL-2025-46116 Malicious code in spark-nextjs-app (npm)
The package spark-nextjs-app was found to contain malicious code...
Malicious code in spark-nextjs-app (npm)
The package spark-nextjs-app was found to contain malicious code...
Linux Distros Unpatched Vulnerability : CVE-2025-55173
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization i...
Linux Distros Unpatched Vulnerability : CVE-2025-49005
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, ...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1016 more potentially affected by CVE-2025-55173 via next (>=15.0.0, <=15.4.1)
next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-55173 Source advisory:...
GHSA-XV57-4MR9-WG8V Next.js Content Injection Vulnerability for Image Optimization
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious...
CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...
Exploit for CVE-2025-29927
CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Byp...
MAL-2025-41331 Malicious code in temp-nextjs (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1cfe72049bd612f29f827f8066a860bf194d84a26a428ae527df672b1428c39b The OpenSSF Package Analysis project identified 'temp-nextjs' @ 99.0....
Malicious code in temp-nextjs (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1cfe72049bd612f29f827f8066a860bf194d84a26a428ae527df672b1428c39b The OpenSSF Package Analysis project identified 'temp-nextjs' @ 99.0....
Malicious code in axios-antimatter-nextjs-leda (npm)
The package axios-antimatter-nextjs-leda was found to contain malicious code...
MAL-2025-27404 Malicious code in nextjs-indus-hugo-asthenosphere (npm)
The package nextjs-indus-hugo-asthenosphere was found to contain malicious code...