4351 matches found
PT-2026-5203
Name of the Vulnerable Software and Affected Versions Next.Js versions 0.0.0 through 1.6.3 Next.Js versions 2.0.0 through 2.0.0 Description A security issue exists in Next.Js related to a permissive cross-domain security policy with untrusted domains, which can lead to Cross-Site Scripting XSS...
Linux Distros Unpatched Vulnerability : CVE-2025-59471
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the fetchExternalImage function, which is used for image optimization and loads external images into memory without a maximum size limit. An attacker ca...
@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +211 more potentially affected by CVE-2025-59471 +1 more via next (>=16.0.0, <=16.1.0)
next NPM version =16.0.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4257, =1.0.4556 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory:...
9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +105 more potentially affected by CVE-2025-59471 +1 more via next (>=16.1.1, <=16.1.4)
next NPM version =16.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory: SNYK:JS-NEXT-15104645...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Partial Prerendering resume endpoint when unauthenticated POST requests with the Next-Resume: 1 header are processed and attacker-controlled postpon...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0to1-builders (0.1.0) +2423 more potentially affected by CVE-2025-59471 +1 more via next (>=15.0.0, <=15.5.27)
next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.10, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory: SNYK:JS-NEXT-15105315...
@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +211 more potentially affected by CVE-2025-59471 +1 more via next (>=16.0.0, <=16.1.0)
next NPM version =16.0.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4257, =1.0.4556 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory:...
9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +105 more potentially affected by CVE-2025-59471 +1 more via next (>=16.1.1, <=16.1.4)
next NPM version =16.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory: SNYK:JS-NEXT-15105315...
CVE-2025-59471
A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint /next/image loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exceptions, or excessive CPU usage by sending...
@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +202 more potentially affected by CVE-2025-55184 +1 more via next (>=16.0.0, <=16.0.10)
next NPM version =16.0.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4257, =1.0.4556 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory:...
@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +129 more potentially affected by CVE-2025-55184 +1 more via next (>=15.4.0-canary.17, <=15.4.10)
next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =0.1.0, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =0.0.3 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...
3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +306 more potentially affected by CVE-2025-55184 +1 more via next (>=15.1.0, <=15.1.11)
next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +300 more potentially affected by CVE-2025-55184 +1 more via next (>=15.3.0, <=15.3.8)
next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...
9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +115 more potentially affected by CVE-2025-55184 +1 more via next (>=16.1.0, <=16.1.4)
next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...
47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +209 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)
next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...
@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2025-55184 +1 more via next (>=15.2.0, <=15.2.8)
next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55184, CVE-2026-238...
CVE-2026-24358
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...
