CVE-2025-13984

The CVE-2025-13984 entry describes a permissive cross-domain security policy in the Drupal-Next.js integration that can enable XSS via cross-origin requests. Affected are Next.js releases before 1.6.4 and before 2.0.1 (i.e., 0.0.0–1.6.3 and 2.0.0–2.0.0). Root cause is permissive CORS/security pol...