From GitHub Advisory Database
Fri, October 23Yesterday
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
影響: npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
next.js cache leak across root param values in nested 'use cache' functions
影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8 With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…
Sentry-Javascript: Middleware Bypass when using Tunnel route
影響: npm:@sentry/nextjs >= 9.36.0, < 9.47.2 → 9.47.2, npm:@sentry/nextjs >= 10.0.0-alpha.0, < 10.75.2 → 10.75.2, npm:@sentry/nextjs >= 11.0.0-alpha.0, < 11.0.0-rc.1 → 11.0.0-rc.1 The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the o and p parameters set. The skip applied to anything under the tunnel pa…
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
影響: npm:next >= 10.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
Next.js: Denial of Service in App Router using Server Actions
影響: npm:next >= 13.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.