@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +249 more potentially affected by unknown CVE via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +267 more potentially affected by unknown CVE via next (>=15.1.1, <=15.1.9)

next NPM version =15.1.1, =0.0.4-alpha-20241218130538-b1235534784f95b3524711b50802add67747c676, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.0.6 - @axle-energy/components 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MWV6-3258-Q52C...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +297 more potentially affected by unknown CVE via next (>=15.3.0, <=15.3.6)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by unknown CVE via next (>=15.4.0-canary.17, <=15.4.8)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MWV6-3258-Q52C...

Next Vulnerable to Denial of Service with Server Components

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184. A malicious HTTP request can...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +249 more potentially affected by CVE-2025-55183 +1 more via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +149 more potentially affected by CVE-2025-55183 +1 more via next (>=16.0.0, <=16.0.8)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.19 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400636...

Deserialization of Untrusted Data

Overview next is a react framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to enter an infinite loop and hang,...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +211 more potentially affected by CVE-2025-55183 +1 more via next (>=15.2.0, <=15.2.6)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55183, CVE-2025-551...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +297 more potentially affected by CVE-2025-55183 +1 more via next (>=15.3.0, <=15.3.6)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +194 more potentially affected by CVE-2025-55183 +1 more via next (>=15.5.0, <=15.5.7)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400636...

Exploit for Deserialization of Untrusted Data in Facebook React

🚀 R2S - Next.js RSC Exploit Framework !Versionhttps://im...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +194 more potentially affected by CVE-2025-55183 +1 more via next (>=15.5.0, <=15.5.7)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +149 more potentially affected by CVE-2025-55183 +1 more via next (>=16.0.0, <=16.0.8)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.19 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +297 more potentially affected by CVE-2025-55183 +1 more via next (>=15.3.0, <=15.3.6)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by CVE-2025-55183 +1 more via next (>=15.4.0-canary.17, <=15.4.8)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.5.0 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +249 more potentially affected by CVE-2025-55183 +1 more via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +211 more potentially affected by CVE-2025-55183 +1 more via next (>=15.2.0, <=15.2.6)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55183, CVE-2025-551...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +304 more potentially affected by CVE-2025-55183 +1 more via next (>=15.1.0, <=15.1.9)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview next is a react framework. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere. An attacker can access the source code of any Server Function by sending a malicious HTTP request to a vulnerable Server Function...