MAL-2025-47521 Malicious code in sha256-validation-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3290610bb31bf5689be7241b664ae5eb52b47b834fff3e2597c5ab75d88c4bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Incorrect Authorization in Vercel Next.Js

CVE-2025-29927 Research and Safe Testing Framework This repos...

MAL-2025-43622 Malicious code in bioinformatics-quantum-apex-nextjs (npm)

The package bioinformatics-quantum-apex-nextjs was found to contain malicious code...

Malicious code in spark-nextjs-app (npm)

The package spark-nextjs-app was found to contain malicious code...

MAL-2025-46116 Malicious code in spark-nextjs-app (npm)

The package spark-nextjs-app was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2025-55173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization i...

Linux Distros Unpatched Vulnerability : CVE-2025-49005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, ...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1056 more potentially affected by CVE-2025-55173 via next (>=15.0.0, <=15.4.1)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-55173 Source advisory:...

GHSA-XV57-4MR9-WG8V Next.js Content Injection Vulnerability for Image Optimization

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious...

CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

Exploit for CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Byp...

Malicious code in temp-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1cfe72049bd612f29f827f8066a860bf194d84a26a428ae527df672b1428c39b The OpenSSF Package Analysis project identified 'temp-nextjs' @ 99.0....

MAL-2025-41331 Malicious code in temp-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1cfe72049bd612f29f827f8066a860bf194d84a26a428ae527df672b1428c39b The OpenSSF Package Analysis project identified 'temp-nextjs' @ 99.0....

Malicious code in axios-antimatter-nextjs-leda (npm)

The package axios-antimatter-nextjs-leda was found to contain malicious code...

Malicious code in cluster-nextjs-html-webpack-plugin-scripts (npm)

The package cluster-nextjs-html-webpack-plugin-scripts was found to contain malicious code...

Malicious code in io-nextjs-loopback-blitz (npm)

The package io-nextjs-loopback-blitz was found to contain malicious code...

Malicious code in mui-nextjs-isostasy-loglevel (npm)

The package mui-nextjs-isostasy-loglevel was found to contain malicious code...

Malicious code in nextjs-fornax-iota-photon (npm)

The package nextjs-fornax-iota-photon was found to contain malicious code...

Malicious code in nextjs-indus-hugo-asthenosphere (npm)

The package nextjs-indus-hugo-asthenosphere was found to contain malicious code...

Malicious code in nextjs-maling (npm)

The package nextjs-maling was found to contain malicious code...