Next.js
Monthly
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) before version 0.5.6 allows remote unauthenticated attackers to defeat the dashboard login lockout by rotating the client-controlled X-9r-Real-Ip header on every password guess, so each request lands in a fresh failed-attempt bucket and the five-attempt progressive 429 lockout never fires. The flaw is exploitable only in deployments where HTTP requests reach Next.js directly without the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; the login endpoint binds to 0.0.0.0 by default, so exposure is network-reachable. Impact is limited to confidentiality (unauthorized administrative session only if the dashboard password is separately weak or guessable) and the throttle removal itself does not yield credentials; no public exploit identified at time of analysis, and the weakness is not listed in CISA KEV.
Prototype pollution in tRPC's @trpc/server package, specifically within the `formDataToObject` function used by the experimental Next.js App Router adapter, allows authenticated remote attackers to modify `Object.prototype` via crafted FormData field names, potentially leading to authorization bypass, denial of service, or other impacts. Affected versions are 10.27.0 through 10.45.2 and 11.0.0 through 11.7.x when using `experimental_nextAppDirCaller`; fixed in 10.45.3 and 11.8.0. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.40% (32nd percentile); the vulnerability is gated by the specific deployment condition of using the experimental adapter with FormData normalization enabled.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability (CVSS 9.1). Critical severity with potential for significant impact on affected systems.
A security vulnerability in Next.js applications. In Auth0 Next.js SDK (CVSS 7.7). High severity vulnerability requiring prompt remediation.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 1.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js versions 1.11.4 through 15.2.2 contain a critical middleware authorization bypass via the x-middleware-subrequest header. Attackers can send crafted requests that skip middleware entirely, bypassing authentication, authorization, and security headers enforced at the middleware layer.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.8%.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) before version 0.5.6 allows remote unauthenticated attackers to defeat the dashboard login lockout by rotating the client-controlled X-9r-Real-Ip header on every password guess, so each request lands in a fresh failed-attempt bucket and the five-attempt progressive 429 lockout never fires. The flaw is exploitable only in deployments where HTTP requests reach Next.js directly without the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; the login endpoint binds to 0.0.0.0 by default, so exposure is network-reachable. Impact is limited to confidentiality (unauthorized administrative session only if the dashboard password is separately weak or guessable) and the throttle removal itself does not yield credentials; no public exploit identified at time of analysis, and the weakness is not listed in CISA KEV.
Prototype pollution in tRPC's @trpc/server package, specifically within the `formDataToObject` function used by the experimental Next.js App Router adapter, allows authenticated remote attackers to modify `Object.prototype` via crafted FormData field names, potentially leading to authorization bypass, denial of service, or other impacts. Affected versions are 10.27.0 through 10.45.2 and 11.0.0 through 11.7.x when using `experimental_nextAppDirCaller`; fixed in 10.45.3 and 11.8.0. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.40% (32nd percentile); the vulnerability is gated by the specific deployment condition of using the experimental adapter with FormData normalization enabled.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability (CVSS 9.1). Critical severity with potential for significant impact on affected systems.
A security vulnerability in Next.js applications. In Auth0 Next.js SDK (CVSS 7.7). High severity vulnerability requiring prompt remediation.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 1.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js versions 1.11.4 through 15.2.2 contain a critical middleware authorization bypass via the x-middleware-subrequest header. Attackers can send crafted requests that skip middleware entirely, bypassing authentication, authorization, and security headers enforced at the middleware layer.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.8%.