https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:42:30.526830+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-03185 bdu:2025-03185 2026-10-03T16:42:30.625458+00:00 bdu:2025-03185 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T16:42:30.625503+00:00 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/cnvd-2025-05716 cnvd-2025-05716 2026-10-03T16:42:30.625524+00:00 cnvd-2025-05716 https://cve.radiocsirt.org/vuln/euvd-2026-227664 EUVD-2026-227664 2026-10-03T16:42:30.625538+00:00 EUVD-2026-227664 https://cve.radiocsirt.org/vuln/fkie_cve-2025-29927 fkie_cve-2025-29927 2026-10-03T16:42:30.625550+00:00

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-f82v-jwr5-mffw GHSA-f82v-jwr5-mffw — Authorization Bypass in Next.js Middleware 2026-10-03T16:42:30.625581+00:00

Affected: npm: next

# Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

# Patches * For Next.js 15.x, this issue is fixed in `15.2.3` * For Next.js 14.x, this issue is fixed in `14.2.25` * For Next.js 13.x, this issue is fixed in 13.5.9 * For Next.js 12.x, this issue is fixed in 12.3.5 * For Next.js 11.x, consult the below workaround.

_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._

# Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.

## Credits

- Allam Rachid (zhero;) - Allam Yasser (inzo_)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0627 WID-SEC-W-2025-0627 — Vercel Next.js: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T16:42:30.625614+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.