Most recent entries from all

bdu:2026-06998

certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0901

CLEANSTART-2026-CN04690 — Security fix for CVE-2026-44573 applied in: jitsucom-jitsu 2.14.0-r1

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-351880

fkie_cve-2026-44573

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

GHSA-36qx-fr4f-26g5 — Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Affected: npm: next

### Impact

Applications using the Pages Router with `i18n` configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less `/_next/data/<buildId>/<page>.json` requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.

### Fix The matcher logic was updated to perform the same match as it would on a non-i18n data route.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

RHSA-2026:34608 — Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization ax…

WID-SEC-W-2026-1401 — Vercel Next.js: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.