https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:29:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-03185 bdu:2025-03185 https://cve.radiocsirt.org/vuln/bdu:2025-03185 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/cnvd-2025-05716 cnvd-2025-05716 https://cve.radiocsirt.org/vuln/cnvd-2025-05716 https://cve.radiocsirt.org/vuln/euvd-2026-227664 EUVD-2026-227664 https://cve.radiocsirt.org/vuln/euvd-2026-227664 https://cve.radiocsirt.org/vuln/fkie_cve-2025-29927 <p>Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.</p> <p>Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-29927 https://cve.radiocsirt.org/vuln/ghsa-f82v-jwr5-mffw <p><strong>Affected:</strong> npm: next</p> <p># Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.</p> <p># Patches * For Next.js 15.x, this issue is fixed in `15.2.3` * For Next.js 14.x, this issue is fixed in `14.2.25` * For Next.js 13.x, this issue is fixed in 13.5.9 * For Next.js 12.x, this issue is fixed in 12.3.5 * For Next.js 11.x, consult the below workaround.</p> <p>_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._</p> <p># Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.</p> <p>## Credits</p> <p>- Allam Rachid (zhero;) - Allam Yasser (inzo_)</p> <p><strong>Affected:</strong> npm: next</p> <p># Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.</p> <p># Patches * For Next.js 15.x, this issue is fixed in `15.2.3` * For Next.js 14.x, this issue is fixed in `14.2.25` * For Next.js 13.x, this issue is fixed in 13.5.9 * For Next.js 12.x, this issue is fixed in 12.3.5 * For Next.js 11.x, consult the below workaround.</p> <p>_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._</p> <p># Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.</p> <p>## Credits</p> <p>- Allam Rachid (zhero;) - Allam Yasser (inzo_)</p> https://cve.radiocsirt.org/vuln/ghsa-f82v-jwr5-mffw https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0627 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0627