Refresh rendered dashboard snapshots
这个提交包含在：
hao
@@ -5,14 +5,14 @@
|
||||
- 系统 ID: `nextjs`
|
||||
- 分类: `frameworks`
|
||||
- 覆盖策略: `history-full`
|
||||
- 总案例数: `66`
|
||||
- 近 30 天新增/更新: `10`
|
||||
- 重点 Markdown 案例数: `41`
|
||||
- 已实证(真实版本): `26`
|
||||
- 总案例数: `0`
|
||||
- 近 30 天新增/更新: `0`
|
||||
- 重点 Markdown 案例数: `0`
|
||||
- 已实证(真实版本): `0`
|
||||
- 已实证(synthetic): `0`
|
||||
- 阻塞数: `0`
|
||||
- 待人工/缺浏览器证据: `40`
|
||||
- 最近渲染时间: `2026-03-18T21:16:45+00:00`
|
||||
- 待人工/缺浏览器证据: `0`
|
||||
- 最近渲染时间: `2026-03-18T21:18:14+00:00`
|
||||
|
||||
## 目标约束
|
||||
|
||||
@@ -32,73 +32,4 @@
|
||||
|
||||
| 标题 | 严重度 | 案例状态 | 实证状态 | 实证方式 | 来源置信度 | 更新时间 | 案例页 |
|
||||
|------|--------|----------|----------|----------|------------|----------|--------|
|
||||
| Next.js: HTTP request smuggling in rewrites | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-17T16:31:26.646070Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2026-29057.md) |
|
||||
| Next.js: Unbounded next/image disk cache growth can exhaust storage | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-17T16:31:33.597080Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2026-27980.md) |
|
||||
| Next.js: Unbounded postponed resume buffering can lead to DoS | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-17T16:31:34.160932Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2026-27979.md) |
|
||||
| Next.js: null origin can bypass Server Actions CSRF checks | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-17T15:46:43.484729Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2026-27978.md) |
|
||||
| Next.js: null origin can bypass dev HMR websocket CSRF checks | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-17T15:46:26.028580Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2026-27977.md) |
|
||||
| Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-13T00:43:52.836085Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md) |
|
||||
| Next.js has Unbounded Memory Consumption via PPR Resume Endpoint | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-06T13:13:43.709252Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md) |
|
||||
| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-10T01:28:46.973023Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md) |
|
||||
| Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:46:38.768104Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md) |
|
||||
| Next Server Actions Source Code Exposure | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:51:40.627151Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md) |
|
||||
| Next Vulnerable to Denial of Service with Server Components | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:55:54.855562Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md) |
|
||||
| Next.js is vulnerable to RCE in React flight protocol | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:45:15.823345Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md) |
|
||||
| Next.js Affected by Cache Key Confusion for Image Optimization API Routes | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:50:08.291668Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md) |
|
||||
| Next.js Content Injection Vulnerability for Image Optimization | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:35:34.538107Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md) |
|
||||
| Next.js Improper Middleware Redirect Handling Leads to SSRF | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:20:45.658010Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md) |
|
||||
| Next.JS vulnerability can lead to DoS via cache poisoning | `low` | `generated` | `verified-real` | `real` | `official` | `2025-07-03T21:49:52Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md) |
|
||||
| Next.js has a Cache poisoning vulnerability due to omission of the Vary header | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:37:18.974477Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md) |
|
||||
| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `verified-real` | `real` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
|
||||
| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
|
||||
| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `verified-real` | `real` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
|
||||
| Authorization Bypass in Next.js Middleware | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-04T15:06:29.993197Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md) |
|
||||
| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
|
||||
| Next.js authorization bypass vulnerability | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
|
||||
| Denial of Service condition in Next.js image optimization | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
|
||||
| Next.js Cache Poisoning | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
|
||||
| Next.js Denial of Service (DoS) condition | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2024-11-06T14:30:33Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-39693.md) |
|
||||
| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
|
||||
| Next.js Vulnerable to HTTP Request Smuggling | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2024-07-09T18:28:18Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34350.md) |
|
||||
| Next.js missing cache-control header may lead to CDN caching empty reply | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:13:42.231979Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2023-46298.md) |
|
||||
| Unexpected server crash in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:09:58.785797Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2022-36046.md) |
|
||||
| Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:08:26.298810Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2022-23646.md) |
|
||||
| Denial of Service Vulnerability in next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:08:09.355091Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2022-21721.md) |
|
||||
| Unexpected server crash in Next.js. | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
|
||||
| XSS in Image Optimization API for Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
|
||||
| Open Redirect in Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
|
||||
| Open Redirect in Next.js versions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:14:13.665535Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md) |
|
||||
| Remote Code Execution in next | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2022-04-28T19:57:43Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5vj8-3v2h-h38v.md) |
|
||||
| Directory Traversal in Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |
|
||||
| Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:00:05.061101Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2018-18282.md) |
|
||||
| Directory traversal vulnerability in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2023-11-08T04:00:21.025418Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2018-6184.md) |
|
||||
| Next.js Directory Traversal Vulnerability | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2024-04-22T19:49:35Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2017-16877.md) |
|
||||
| Actions | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Next | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Sign in | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Discussions | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Denial of Service in Partial Pre Rendering | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Denial of Service with Server Components - Incomplete Fix Follow-Up | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| next.js | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| 4 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| 3 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| null origin can bypass Server Actions CSRF checks | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Security
|
||||
36 | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Insights | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Server Actions Source Code Exposure | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Star
|
||||
138k | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Denial of Service with Server Components | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Skip to content | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Sign up | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Denial of Service in Image Optimizer | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Unbounded next/image disk cache growth can exhaust storage | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Policy | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| null origin can bypass dev HMR websocket CSRF checks | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| HTTP request smuggling in rewrites | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Pull requests
|
||||
1.4k | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Unbounded postponed resume buffering can lead to DoS | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| Issues
|
||||
2.1k | `unknown` | `triage` | `triage-manual` | `synthetic` | `official` | `` | - |
|
||||
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | `n/a` | `n/a` | - |
|
||||
|
||||
在新工单中引用
屏蔽一个用户