https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 18:29:04 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/euvd-2026-239568 EUVD-2026-239568 https://cve.radiocsirt.org/vuln/euvd-2026-239568 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32421 <p>Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel&#39;s platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.</p> <p>Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel&#39;s platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-32421 https://cve.radiocsirt.org/vuln/ghsa-qpjv-v59x-3qc4 <p><strong>Affected:</strong> npm: next</p> <p>**Summary** We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML.</p> <p>[Learn more here](https://vercel.com/changelog/cve-2025-32421)</p> <p>**Credit** Thank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.</p> <p><strong>Affected:</strong> npm: next</p> <p>**Summary** We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the **Pages Router** under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML.</p> <p>[Learn more here](https://vercel.com/changelog/cve-2025-32421)</p> <p>**Credit** Thank you to **Allam Rachid (zhero)** for the responsible disclosure. This research was rewarded as part of our bug bounty program.</p> https://cve.radiocsirt.org/vuln/ghsa-qpjv-v59x-3qc4 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1061 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1061