Most recent entries from all

bdu:2024-11376

2026-10-15T23:49:35.314849+00:00

bdu:2024-11376

certfr-2025-avi-0279 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-15T23:49:35.314887+00:00

certfr-2025-avi-0279

EUVD-2026-207312

2026-10-15T23:49:35.314906+00:00

EUVD-2026-207312

fkie_cve-2024-51479

2026-10-15T23:49:35.314918+00:00

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

GHSA-7gfc-8cq8-jh5f — Next.js authorization bypass vulnerability

2026-10-15T23:49:35.314951+00:00

Affected: npm: next

### Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

### Patches This issue was patched in Next.js `14.2.15` and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

### Workarounds There are no official workarounds for this vulnerability.

#### Credits We'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

RHSA-2025:3807 — Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release

2026-10-15T23:49:35.314979+00:00

next.js: next: authorization bypass in Next.js next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions