https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:29:28 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1137 certfr-2025-avi-1137 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1137 https://cve.radiocsirt.org/vuln/euvd-2026-251713 EUVD-2026-251713 https://cve.radiocsirt.org/vuln/euvd-2026-251713 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57822 <p>Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.</p> <p>Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-57822 https://cve.radiocsirt.org/vuln/ghsa-4342-x723-ch2f <p><strong>Affected:</strong> npm: next</p> <p>A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.</p> <p>All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.</p> <p>More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)</p> <p><strong>Affected:</strong> npm: next</p> <p>A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.</p> <p>All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.</p> <p>More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)</p> https://cve.radiocsirt.org/vuln/ghsa-4342-x723-ch2f https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1934 <p>Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren und so Server-Side Request Forgery- oder Phishing-Angriffe durchzuführen.</p> <p>Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren und so Server-Side Request Forgery- oder Phishing-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1934