Most recent entries from all

CLEANSTART-2026-FI73865 — Security fix for CVE-2026-64642 applied in: langfuse 3.208.0-r1, langfuse 3.213.0-r1

2026-10-03T05:22:08.468887+00:00

Affected: CleanStart: langfuse

CVE-2026-64642 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-342092

2026-10-03T05:22:08.468932+00:00

EUVD-2026-342092

fkie_cve-2026-64642

2026-10-03T05:22:08.468949+00:00

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

GHSA-6gpp-xcg3-4w24 — Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

2026-10-03T05:22:08.468971+00:00

Affected: npm: next

## Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.

## Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

WID-SEC-W-2026-2468 — Vercel Next.js: Mehrere Schwachstellen

2026-10-03T05:22:08.468994+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.