https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:49:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-11376 bdu:2024-11376 https://cve.radiocsirt.org/vuln/bdu:2024-11376 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/euvd-2026-207312 EUVD-2026-207312 https://cve.radiocsirt.org/vuln/euvd-2026-207312 https://cve.radiocsirt.org/vuln/fkie_cve-2024-51479 <p>Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application&#39;s root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.</p> <p>Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application&#39;s root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-51479 https://cve.radiocsirt.org/vuln/ghsa-7gfc-8cq8-jh5f <p><strong>Affected:</strong> npm: next</p> <p>### Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.</p> <p>### Patches This issue was patched in Next.js `14.2.15` and later.</p> <p>If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.</p> <p>### Workarounds There are no official workarounds for this vulnerability.</p> <p>#### Credits We&#39;d like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.</p> <p><strong>Affected:</strong> npm: next</p> <p>### Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.</p> <p>### Patches This issue was patched in Next.js `14.2.15` and later.</p> <p>If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.</p> <p>### Workarounds There are no official workarounds for this vulnerability.</p> <p>#### Credits We&#39;d like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-7gfc-8cq8-jh5f https://cve.radiocsirt.org/vuln/rhsa-2025:3807 <p>next.js: next: authorization bypass in Next.js next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions</p> <p>next.js: next: authorization bypass in Next.js next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3807