hao/websafe-kb
1
0
派生 0
代码 工单 合并请求 1 工作流 软件包 项目 发布 百科 活动

kb: expand authorized lab coverage and intel automation

浏览代码
这个提交包含在：
hao
2026-03-16 22:04:51 -07:00
父节点 cda31e86c7
当前提交 d0120fbf10
共修改 592 个文件，包含 29025 行新增和 267 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件

13
07-framework-security/README.md 普通文件
查看文件

@@ -0,0 +1,13 @@
# 主流开源 Web 系统安全
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 系统总数: `62`
- 覆盖语境: 授权攻防实验、验证性注入、最小化验证、案例映射。
- 不适用: 未授权公网目标、泛互联网枚举、默认生产推荐基线。
- [cms](/Users/x/websafe/07-framework-security/cms/README.md)
- [ecommerce](/Users/x/websafe/07-framework-security/ecommerce/README.md)
- [frameworks](/Users/x/websafe/07-framework-security/frameworks/README.md)
- [servers](/Users/x/websafe/07-framework-security/servers/README.md)
- [platforms](/Users/x/websafe/07-framework-security/platforms/README.md)

16
07-framework-security/cms/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# cms
> 自动生成系统分组索引
- 系统数量: `9`
- 允许范围: `lab-local`, `lab-public`, `authorized-third-party`
- [Directus](/Users/x/websafe/07-framework-security/cms/directus/README.md)
- [Discourse](/Users/x/websafe/07-framework-security/cms/discourse/README.md)
- [Drupal](/Users/x/websafe/07-framework-security/cms/drupal/README.md)
- [Ghost](/Users/x/websafe/07-framework-security/cms/ghost/README.md)
- [Joomla](/Users/x/websafe/07-framework-security/cms/joomla/README.md)
- [MediaWiki](/Users/x/websafe/07-framework-security/cms/mediawiki/README.md)
- [Moodle](/Users/x/websafe/07-framework-security/cms/moodle/README.md)
- [Strapi](/Users/x/websafe/07-framework-security/cms/strapi/README.md)
- [WordPress](/Users/x/websafe/07-framework-security/cms/wordpress/README.md)

30
07-framework-security/cms/directus/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Directus
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `directus`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Directus GitHub Advisories](https://github.com/directus/directus/security/advisories) (mode=core)
- `official` [OSV Directus](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/directus/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Directus
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/cms/directus`
- 修复主题: authz-server-side-recheck, token-cookie-storage, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/directus/INDEX.md)
- Registry 统计: [directus.json](/Users/x/websafe/08-threat-intel/registry/systems/directus.json)

30
07-framework-security/cms/discourse/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Discourse
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `discourse`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Discourse Meta Security](https://meta.discourse.org/c/bug/security/40) (mode=core)
- `official` [GitHub Discourse Advisories](https://github.com/discourse/discourse/security/advisories) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/discourse/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Discourse
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, plugin
- 输出目录: `07-framework-security/cms/discourse`
- 修复主题: authz-server-side-recheck, xss-output-encoding, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/discourse/INDEX.md)
- Registry 统计: [discourse.json](/Users/x/websafe/08-threat-intel/registry/systems/discourse.json)

31
07-framework-security/cms/drupal/INDEX.md 普通文件
查看文件

@@ -0,0 +1,31 @@
# Drupal
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `drupal`
- 分类: `cms`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Drupal Security Advisories RSS](https://www.drupal.org/security/rss.xml) (mode=core)
- `official` [NVD Drupal](https://nvd.nist.gov/vuln/search) (keyword=Drupal; mode=core)
- `ecosystem-authority` [Drupal Security Advisories Site](https://www.drupal.org/security) (mode=module)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/drupal/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Drupal
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `history-full`
- Advisory 模式: core, module
- 输出目录: `07-framework-security/cms/drupal`
- 修复主题: authz-server-side-recheck, xss-output-encoding, file-upload-validation, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/drupal/INDEX.md)
- Registry 统计: [drupal.json](/Users/x/websafe/08-threat-intel/registry/systems/drupal.json)

30
07-framework-security/cms/ghost/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Ghost
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `ghost`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Ghost GitHub Advisories](https://github.com/TryGhost/Ghost/security/advisories) (mode=core)
- `official` [NVD Ghost](https://nvd.nist.gov/vuln/search) (keyword=Ghost CMS; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/ghost/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Ghost
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/cms/ghost`
- 修复主题: authz-server-side-recheck, xss-output-encoding, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/ghost/INDEX.md)
- Registry 统计: [ghost.json](/Users/x/websafe/08-threat-intel/registry/systems/ghost.json)

30
07-framework-security/cms/joomla/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Joomla
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `joomla`
- 分类: `cms`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Joomla Security Centre](https://developer.joomla.org/security-centre.html) (mode=core)
- `official` [NVD Joomla](https://nvd.nist.gov/vuln/search) (keyword=Joomla; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/joomla/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Joomla
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/cms/joomla`
- 修复主题: xss-output-encoding, file-upload-validation, path-traversal-guard, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/joomla/INDEX.md)
- Registry 统计: [joomla.json](/Users/x/websafe/08-threat-intel/registry/systems/joomla.json)

30
07-framework-security/cms/mediawiki/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# MediaWiki
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `mediawiki`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [MediaWiki Security Releases](https://www.mediawiki.org/wiki/Security) (mode=core)
- `official` [NVD MediaWiki](https://nvd.nist.gov/vuln/search) (keyword=MediaWiki; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/mediawiki/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# MediaWiki
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/cms/mediawiki`
- 修复主题: xss-output-encoding, authz-server-side-recheck, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/mediawiki/INDEX.md)
- Registry 统计: [mediawiki.json](/Users/x/websafe/08-threat-intel/registry/systems/mediawiki.json)

30
07-framework-security/cms/moodle/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Moodle
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `moodle`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Moodle Security News](https://moodle.org/security/) (mode=core)
- `official` [NVD Moodle](https://nvd.nist.gov/vuln/search) (keyword=Moodle; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/moodle/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Moodle
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, plugin
- 输出目录: `07-framework-security/cms/moodle`
- 修复主题: authz-server-side-recheck, xss-output-encoding, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/moodle/INDEX.md)
- Registry 统计: [moodle.json](/Users/x/websafe/08-threat-intel/registry/systems/moodle.json)

30
07-framework-security/cms/strapi/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Strapi
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `strapi`
- 分类: `cms`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Strapi GitHub Advisories](https://github.com/strapi/strapi/security/advisories) (mode=core)
- `official` [OSV Strapi](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/strapi/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Strapi
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, plugin
- 输出目录: `07-framework-security/cms/strapi`
- 修复主题: authz-server-side-recheck, token-cookie-storage, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/strapi/INDEX.md)
- Registry 统计: [strapi.json](/Users/x/websafe/08-threat-intel/registry/systems/strapi.json)

34
07-framework-security/cms/wordpress/INDEX.md 普通文件
查看文件

@@ -0,0 +1,34 @@
# WordPress
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `wordpress`
- 分类: `cms`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [WordPress Security News](https://wordpress.org/news/category/security/) (mode=core)
- `official` [NVD WordPress](https://nvd.nist.gov/vuln/search) (keyword=WordPress; mode=core)
- `ecosystem-authority` [Wordfence Vulnerability Database](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/) (mode=plugin)
- `ecosystem-authority` [Patchstack Database](https://patchstack.com/database/) (mode=plugin)
- `ecosystem-authority` [WPScan Vulnerability Database](https://wpscan.com/blog/) (mode=plugin)
- `research` [PortSwigger Research](https://portswigger.net/research) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/cms/wordpress/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# WordPress
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `cms`
- 覆盖层级: `history-full`
- Advisory 模式: core, plugin
- 输出目录: `07-framework-security/cms/wordpress`
- 修复主题: plugin-extension-trust-policy, xss-output-encoding, file-upload-validation, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/cms/wordpress/INDEX.md)
- Registry 统计: [wordpress.json](/Users/x/websafe/08-threat-intel/registry/systems/wordpress.json)

16
07-framework-security/ecommerce/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# ecommerce
> 自动生成系统分组索引
- 系统数量: `9`
- 允许范围: `lab-local`, `lab-public`, `authorized-third-party`
- [Adobe Commerce](/Users/x/websafe/07-framework-security/ecommerce/adobe-commerce/README.md)
- [Magento Open Source](/Users/x/websafe/07-framework-security/ecommerce/magento-open-source/README.md)
- [Medusa](/Users/x/websafe/07-framework-security/ecommerce/medusa/README.md)
- [OpenCart](/Users/x/websafe/07-framework-security/ecommerce/opencart/README.md)
- [OpenMage / Mage-OS](/Users/x/websafe/07-framework-security/ecommerce/openmage/README.md)
- [PrestaShop](/Users/x/websafe/07-framework-security/ecommerce/prestashop/README.md)
- [Saleor](/Users/x/websafe/07-framework-security/ecommerce/saleor/README.md)
- [Shopware](/Users/x/websafe/07-framework-security/ecommerce/shopware/README.md)
- [WooCommerce](/Users/x/websafe/07-framework-security/ecommerce/woocommerce/README.md)

31
07-framework-security/ecommerce/adobe-commerce/INDEX.md 普通文件
查看文件

@@ -0,0 +1,31 @@
# Adobe Commerce
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `adobe-commerce`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Adobe Security Bulletins](https://helpx.adobe.com/security/products/magento.html) (mode=core)
- `official` [NVD Adobe Commerce](https://nvd.nist.gov/vuln/search) (keyword=Adobe Commerce; mode=core)
- `ecosystem-authority` [Sansec Research](https://sansec.io/research) (mode=extension)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/adobe-commerce/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Adobe Commerce
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/adobe-commerce`
- 修复主题: authz-server-side-recheck, file-upload-validation, xss-output-encoding, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/adobe-commerce/INDEX.md)
- Registry 统计: [adobe-commerce.json](/Users/x/websafe/08-threat-intel/registry/systems/adobe-commerce.json)

31
07-framework-security/ecommerce/magento-open-source/INDEX.md 普通文件
查看文件

@@ -0,0 +1,31 @@
# Magento Open Source
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `magento-open-source`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Magento GitHub Advisories](https://github.com/magento/magento2/security/advisories) (mode=core)
- `official` [NVD Magento](https://nvd.nist.gov/vuln/search) (keyword=Magento; mode=core)
- `ecosystem-authority` [Sansec Research](https://sansec.io/research) (mode=extension)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/magento-open-source/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Magento Open Source
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/magento-open-source`
- 修复主题: authz-server-side-recheck, file-upload-validation, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/magento-open-source/INDEX.md)
- Registry 统计: [magento-open-source.json](/Users/x/websafe/08-threat-intel/registry/systems/magento-open-source.json)

30
07-framework-security/ecommerce/medusa/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Medusa
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `medusa`
- 分类: `ecommerce`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Medusa Advisories](https://github.com/medusajs/medusa/security/advisories) (mode=core)
- `official` [OSV Medusa](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/medusa/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Medusa
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/medusa`
- 修复主题: authz-server-side-recheck, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/medusa/INDEX.md)
- Registry 统计: [medusa.json](/Users/x/websafe/08-threat-intel/registry/systems/medusa.json)

30
07-framework-security/ecommerce/opencart/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# OpenCart
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `opencart`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [OpenCart Releases](https://github.com/opencart/opencart/releases) (mode=core)
- `official` [NVD OpenCart](https://nvd.nist.gov/vuln/search) (keyword=OpenCart; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/opencart/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# OpenCart
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/opencart`
- 修复主题: authz-server-side-recheck, plugin-extension-trust-policy, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/opencart/INDEX.md)
- Registry 统计: [opencart.json](/Users/x/websafe/08-threat-intel/registry/systems/opencart.json)

30
07-framework-security/ecommerce/openmage/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# OpenMage / Mage-OS
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `openmage`
- 分类: `ecommerce`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [OpenMage GitHub Advisories](https://github.com/OpenMage/magento-lts/security/advisories) (mode=core)
- `official` [NVD OpenMage](https://nvd.nist.gov/vuln/search) (keyword=OpenMage; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/openmage/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# OpenMage / Mage-OS
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/openmage`
- 修复主题: authz-server-side-recheck, plugin-extension-trust-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/openmage/INDEX.md)
- Registry 统计: [openmage.json](/Users/x/websafe/08-threat-intel/registry/systems/openmage.json)

31
07-framework-security/ecommerce/prestashop/INDEX.md 普通文件
查看文件

@@ -0,0 +1,31 @@
# PrestaShop
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `prestashop`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [PrestaShop Security Page](https://build.prestashop-project.org/news/) (mode=core)
- `official` [GitHub PrestaShop Advisories](https://github.com/PrestaShop/PrestaShop/security/advisories) (mode=core)
- `ecosystem-authority` [Friends Of Presta Security](https://security.friendsofpresta.org/) (mode=module)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/prestashop/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# PrestaShop
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, module
- 输出目录: `07-framework-security/ecommerce/prestashop`
- 修复主题: plugin-extension-trust-policy, authz-server-side-recheck, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/prestashop/INDEX.md)
- Registry 统计: [prestashop.json](/Users/x/websafe/08-threat-intel/registry/systems/prestashop.json)

30
07-framework-security/ecommerce/saleor/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Saleor
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `saleor`
- 分类: `ecommerce`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Saleor Advisories](https://github.com/saleor/saleor/security/advisories) (mode=core)
- `official` [NVD Saleor](https://nvd.nist.gov/vuln/search) (keyword=Saleor; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/saleor/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Saleor
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/saleor`
- 修复主题: authz-server-side-recheck, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/saleor/INDEX.md)
- Registry 统计: [saleor.json](/Users/x/websafe/08-threat-intel/registry/systems/saleor.json)

30
07-framework-security/ecommerce/shopware/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Shopware
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `shopware`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Shopware Security Advisories](https://github.com/shopware/shopware/security/advisories) (mode=core)
- `official` [NVD Shopware](https://nvd.nist.gov/vuln/search) (keyword=Shopware; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/shopware/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Shopware
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/shopware`
- 修复主题: authz-server-side-recheck, plugin-extension-trust-policy, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/shopware/INDEX.md)
- Registry 统计: [shopware.json](/Users/x/websafe/08-threat-intel/registry/systems/shopware.json)

32
07-framework-security/ecommerce/woocommerce/INDEX.md 普通文件
查看文件

@@ -0,0 +1,32 @@
# WooCommerce
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `woocommerce`
- 分类: `ecommerce`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Woo Developer Advisories](https://developer.woocommerce.com/) (mode=core)
- `official` [GitHub WooCommerce Advisories](https://github.com/woocommerce/woocommerce/security/advisories) (mode=core)
- `ecosystem-authority` [Patchstack Database](https://patchstack.com/database/) (mode=extension)
- `ecosystem-authority` [Wordfence Vulnerability Database](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/) (mode=extension)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/ecommerce/woocommerce/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# WooCommerce
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `ecommerce`
- 覆盖层级: `history-full`
- Advisory 模式: core, extension
- 输出目录: `07-framework-security/ecommerce/woocommerce`
- 修复主题: plugin-extension-trust-policy, xss-output-encoding, authz-server-side-recheck
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/ecommerce/woocommerce/INDEX.md)
- Registry 统计: [woocommerce.json](/Users/x/websafe/08-threat-intel/registry/systems/woocommerce.json)

36
07-framework-security/frameworks/README.md 普通文件
查看文件

@@ -0,0 +1,36 @@
# frameworks
> 自动生成系统分组索引
- 系统数量: `29`
- 允许范围: `lab-local`, `lab-public`, `authorized-third-party`
- [Angular](/Users/x/websafe/07-framework-security/frameworks/angular/README.md)
- [ASP.NET Core](/Users/x/websafe/07-framework-security/frameworks/aspnet-core/README.md)
- [Astro](/Users/x/websafe/07-framework-security/frameworks/astro/README.md)
- [Django](/Users/x/websafe/07-framework-security/frameworks/django/README.md)
- [Echo](/Users/x/websafe/07-framework-security/frameworks/echo/README.md)
- [esbuild](/Users/x/websafe/07-framework-security/frameworks/esbuild/README.md)
- [Express](/Users/x/websafe/07-framework-security/frameworks/express/README.md)
- [Fastify](/Users/x/websafe/07-framework-security/frameworks/fastify/README.md)
- [Flask](/Users/x/websafe/07-framework-security/frameworks/flask/README.md)
- [Gin](/Users/x/websafe/07-framework-security/frameworks/gin/README.md)
- [Hapi](/Users/x/websafe/07-framework-security/frameworks/hapi/README.md)
- [Koa](/Users/x/websafe/07-framework-security/frameworks/koa/README.md)
- [Laravel](/Users/x/websafe/07-framework-security/frameworks/laravel/README.md)
- [NestJS](/Users/x/websafe/07-framework-security/frameworks/nestjs/README.md)
- [Next.js](/Users/x/websafe/07-framework-security/frameworks/nextjs/README.md)
- [Node.js](/Users/x/websafe/07-framework-security/frameworks/nodejs/README.md)
- [Nuxt](/Users/x/websafe/07-framework-security/frameworks/nuxt/README.md)
- [React](/Users/x/websafe/07-framework-security/frameworks/react/README.md)
- [Ruby on Rails](/Users/x/websafe/07-framework-security/frameworks/rails/README.md)
- [Spring Boot](/Users/x/websafe/07-framework-security/frameworks/spring-boot/README.md)
- [Spring Framework](/Users/x/websafe/07-framework-security/frameworks/spring-framework/README.md)
- [Spring Security](/Users/x/websafe/07-framework-security/frameworks/spring-security/README.md)
- [SvelteKit](/Users/x/websafe/07-framework-security/frameworks/sveltekit/README.md)
- [Symfony](/Users/x/websafe/07-framework-security/frameworks/symfony/README.md)
- [Undici](/Users/x/websafe/07-framework-security/frameworks/undici/README.md)
- [Vite](/Users/x/websafe/07-framework-security/frameworks/vite/README.md)
- [Vue](/Users/x/websafe/07-framework-security/frameworks/vue/README.md)
- [webpack](/Users/x/websafe/07-framework-security/frameworks/webpack/README.md)
- [Werkzeug](/Users/x/websafe/07-framework-security/frameworks/werkzeug/README.md)

30
07-framework-security/frameworks/angular/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Angular
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `angular`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Angular](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/angular/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Angular
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/angular`
- 修复主题: xss-output-encoding, template-injection-guard, csp-trusted-types
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/angular/INDEX.md)
- Registry 统计: [angular.json](/Users/x/websafe/08-threat-intel/registry/systems/angular.json)

29
07-framework-security/frameworks/aspnet-core/INDEX.md 普通文件
查看文件

@@ -0,0 +1,29 @@
# ASP.NET Core
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `aspnet-core`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [NVD ASP.NET Core](https://nvd.nist.gov/vuln/search) (keyword=ASP.NET Core; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/aspnet-core/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# ASP.NET Core
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/aspnet-core`
- 修复主题: authz-server-side-recheck, xss-output-encoding, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/aspnet-core/INDEX.md)
- Registry 统计: [aspnet-core.json](/Users/x/websafe/08-threat-intel/registry/systems/aspnet-core.json)

30
07-framework-security/frameworks/astro/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Astro
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `astro`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Astro](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/astro/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Astro
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/astro`
- 修复主题: authz-server-side-recheck, csp-trusted-types
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/astro/INDEX.md)
- Registry 统计: [astro.json](/Users/x/websafe/08-threat-intel/registry/systems/astro.json)

30
07-framework-security/frameworks/django/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Django
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `django`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Django Security RSS](https://www.djangoproject.com/weblog/feeds/tags/security/) (mode=core)
- `official` [OSV Django](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/django/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Django
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/django`
- 修复主题: xss-output-encoding, path-traversal-guard, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/django/INDEX.md)
- Registry 统计: [django.json](/Users/x/websafe/08-threat-intel/registry/systems/django.json)

29
07-framework-security/frameworks/echo/INDEX.md 普通文件
查看文件

@@ -0,0 +1,29 @@
# Echo
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `echo`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [OSV Echo](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/echo/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Echo
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/echo`
- 修复主题: proxy-trust-boundary, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/echo/INDEX.md)
- Registry 统计: [echo.json](/Users/x/websafe/08-threat-intel/registry/systems/echo.json)

30
07-framework-security/frameworks/esbuild/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# esbuild
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `esbuild`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV esbuild](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/esbuild/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# esbuild
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/esbuild`
- 修复主题: dependency-upgrade-policy, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/esbuild/INDEX.md)
- Registry 统计: [esbuild.json](/Users/x/websafe/08-threat-intel/registry/systems/esbuild.json)

30
07-framework-security/frameworks/express/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Express
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `express`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Express](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/express/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Express
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/express`
- 修复主题: xss-output-encoding, ssrf-url-validation, proxy-trust-boundary
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/express/INDEX.md)
- Registry 统计: [express.json](/Users/x/websafe/08-threat-intel/registry/systems/express.json)

30
07-framework-security/frameworks/fastify/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Fastify
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `fastify`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Fastify](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/fastify/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Fastify
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/fastify`
- 修复主题: proxy-trust-boundary, ssrf-url-validation, xss-output-encoding
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/fastify/INDEX.md)
- Registry 统计: [fastify.json](/Users/x/websafe/08-threat-intel/registry/systems/fastify.json)

30
07-framework-security/frameworks/flask/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Flask
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `flask`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [OSV Flask](https://osv.dev/) (mode=core)
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=pip; mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/flask/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Flask
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/flask`
- 修复主题: xss-output-encoding, ssrf-url-validation, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/flask/INDEX.md)
- Registry 统计: [flask.json](/Users/x/websafe/08-threat-intel/registry/systems/flask.json)

29
07-framework-security/frameworks/gin/INDEX.md 普通文件
查看文件

@@ -0,0 +1,29 @@
# Gin
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `gin`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [OSV Gin](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/gin/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Gin
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/gin`
- 修复主题: proxy-trust-boundary, xss-output-encoding
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/gin/INDEX.md)
- Registry 统计: [gin.json](/Users/x/websafe/08-threat-intel/registry/systems/gin.json)

30
07-framework-security/frameworks/hapi/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Hapi
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `hapi`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Hapi](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/hapi/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Hapi
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/hapi`
- 修复主题: proxy-trust-boundary, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/hapi/INDEX.md)
- Registry 统计: [hapi.json](/Users/x/websafe/08-threat-intel/registry/systems/hapi.json)

30
07-framework-security/frameworks/koa/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Koa
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `koa`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Koa](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/koa/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Koa
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/koa`
- 修复主题: proxy-trust-boundary, ssrf-url-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/koa/INDEX.md)
- Registry 统计: [koa.json](/Users/x/websafe/08-threat-intel/registry/systems/koa.json)

30
07-framework-security/frameworks/laravel/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Laravel
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `laravel`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=composer; mode=core)
- `official` [OSV Laravel](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/laravel/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Laravel
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/laravel`
- 修复主题: xss-output-encoding, authz-server-side-recheck, file-upload-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/laravel/INDEX.md)
- Registry 统计: [laravel.json](/Users/x/websafe/08-threat-intel/registry/systems/laravel.json)

30
07-framework-security/frameworks/nestjs/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# NestJS
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `nestjs`
- 分类: `frameworks`
- 覆盖策略: `rolling-24m`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV NestJS](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/nestjs/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# NestJS
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `rolling-24m`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/nestjs`
- 修复主题: authz-server-side-recheck, token-cookie-storage, ssrf-url-validation
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/nestjs/INDEX.md)
- Registry 统计: [nestjs.json](/Users/x/websafe/08-threat-intel/registry/systems/nestjs.json)

56
07-framework-security/frameworks/nextjs/INDEX.md 普通文件
查看文件

@@ -0,0 +1,56 @@
# Next.js
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `nextjs`
- 分类: `frameworks`
- 覆盖策略: `history-full`
- 总案例数: `26`
- 近 30 天新增/更新: `5`
- 重点 Markdown 案例数: `26`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [GitHub Next.js Advisories](https://github.com/vercel/next.js/security/advisories) (mode=core)
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Next.js](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components | `low` | `generated` | `official` | `2026-02-13T00:43:52.836085Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md) |
| Next.js has Unbounded Memory Consumption via PPR Resume Endpoint | `low` | `generated` | `official` | `2026-02-06T13:13:43.709252Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md) |
| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | `low` | `generated` | `official` | `2026-02-10T01:28:46.973023Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md) |
| Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | `low` | `generated` | `official` | `2026-02-04T02:46:38.768104Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md) |
| Next Server Actions Source Code Exposure | `low` | `generated` | `official` | `2026-02-04T02:51:40.627151Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md) |
| Next Vulnerable to Denial of Service with Server Components | `low` | `generated` | `official` | `2026-02-04T03:55:54.855562Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md) |
| Next.js is vulnerable to RCE in React flight protocol | `low` | `generated` | `official` | `2026-02-04T03:45:15.823345Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md) |
| Next.js Affected by Cache Key Confusion for Image Optimization API Routes | `low` | `generated` | `official` | `2026-02-04T02:50:08.291668Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md) |
| Next.js Content Injection Vulnerability for Image Optimization | `low` | `generated` | `official` | `2026-02-04T04:35:34.538107Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md) |
| Next.js Improper Middleware Redirect Handling Leads to SSRF | `low` | `generated` | `official` | `2026-02-04T04:20:45.658010Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md) |
| Next.JS vulnerability can lead to DoS via cache poisoning | `low` | `generated` | `official` | `2025-07-03T21:49:52Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md) |
| Next.js has a Cache poisoning vulnerability due to omission of the Vary header | `low` | `generated` | `official` | `2026-02-04T02:37:18.974477Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md) |
| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
| Authorization Bypass in Next.js Middleware | `low` | `generated` | `official` | `2026-03-04T15:06:29.993197Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md) |
| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
| Next.js authorization bypass vulnerability | `low` | `generated` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
| Denial of Service condition in Next.js image optimization | `low` | `generated` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
| Next.js Cache Poisoning | `low` | `generated` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
| Unexpected server crash in Next.js. | `low` | `generated` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
| XSS in Image Optimization API for Next.js | `low` | `generated` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
| Open Redirect in Next.js | `low` | `generated` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
| Open Redirect in Next.js versions | `low` | `generated` | `official` | `2026-03-13T22:14:13.665535Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md) |
| Directory Traversal in Next.js | `low` | `generated` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |

16
07-framework-security/frameworks/nextjs/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Next.js
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `history-full`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/nextjs`
- 修复主题: authz-server-side-recheck, proxy-trust-boundary, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/nextjs/INDEX.md)
- Registry 统计: [nextjs.json](/Users/x/websafe/08-threat-intel/registry/systems/nextjs.json)

83
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md 普通文件
查看文件

@@ -0,0 +1,83 @@
---
title: "Open Redirect in Next.js versions"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2020-10-08T19:28:07Z"
updated_date: "2026-03-13T22:14:13.665535Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2020-15242"
- "GHSA-x56p-c8cg-q435"
affected_versions:
- "introduced=9.5.0, fixed<9.5.4"
fixed_versions:
- "9.5.4"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435"
---
# Open Redirect in Next.js versions
## 事件层
- Canonical ID: `nextjs--CVE-2020-15242`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
- 影响版本: `introduced=9.5.0, fixed<9.5.4`
- 修复版本: `9.5.4`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2020-15242
- https://github.com/vercel/next.js
- https://github.com/zeit/next.js/releases/tag/v9.5.4
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

92
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md 普通文件
查看文件

@@ -0,0 +1,92 @@
---
title: "Directory Traversal in Next.js"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2020-03-30T20:40:50Z"
updated_date: "2025-09-26T17:49:56Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2020-5284"
- "GHSA-fq77-7p7r-83rj"
affected_versions:
- "introduced=0.9.9, fixed<9.3.2"
fixed_versions:
- "9.3.2"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "path-traversal-guard"
primary_source: "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
---
# Directory Traversal in Next.js
## 事件层
- Canonical ID: `nextjs--CVE-2020-5284`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
- 影响版本: `introduced=0.9.9, fixed<9.3.2`
- 修复版本: `9.3.2`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2020-5284
- https://github.com/zeit/next.js/releases/tag/v9.3.2
- https://www.npmjs.com/advisories/1503
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/javascript-typescript/path-traversal-guard.md)
- [nodejs:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/nodejs/path-traversal-guard.md)
- [java:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/java/path-traversal-guard.md)
- [php:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/php/path-traversal-guard.md)
- [python:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/python/path-traversal-guard.md)
- [ruby:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/ruby/path-traversal-guard.md)
- [csharp:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/csharp/path-traversal-guard.md)
- [go:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/go/path-traversal-guard.md)

92
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md 普通文件
查看文件

@@ -0,0 +1,92 @@
---
title: "Open Redirect in Next.js"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2021-08-12T14:51:14Z"
updated_date: "2026-03-13T22:00:08.038285Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2021-37699"
- "GHSA-vxf5-wxwp-m7g9"
affected_versions:
- "introduced=0.9.9, fixed<11.1.0"
fixed_versions:
- "11.1.0"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9"
---
# Open Redirect in Next.js
## 事件层
- Canonical ID: `nextjs--CVE-2021-37699`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9
- 影响版本: `introduced=0.9.9, fixed<11.1.0`
- 修复版本: `11.1.0`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2021-37699
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v11.1.0
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)

94
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md 普通文件
查看文件

@@ -0,0 +1,94 @@
---
title: "XSS in Image Optimization API for Next.js"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2021-09-01T18:24:22Z"
updated_date: "2026-03-13T22:00:20.154452Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2021-39178"
- "GHSA-9gr3-7897-pp7m"
affected_versions:
- "introduced=10.0.0, fixed<11.1.1"
fixed_versions:
- "11.1.1"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "xss-output-encoding"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m"
---
# XSS in Image Optimization API for Next.js
## 事件层
- Canonical ID: `nextjs--CVE-2021-39178`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
- 影响版本: `introduced=10.0.0, fixed<11.1.1`
- 修复版本: `11.1.1`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2021-39178
- https://github.com/vercel/next.js/pull/28620
- https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v11.1.1
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/javascript-typescript/xss-output-encoding.md)
- [nodejs:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/nodejs/xss-output-encoding.md)
- [java:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/java/xss-output-encoding.md)
- [php:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/php/xss-output-encoding.md)
- [python:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/python/xss-output-encoding.md)
- [ruby:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/ruby/xss-output-encoding.md)
- [csharp:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/csharp/xss-output-encoding.md)
- [go:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/go/xss-output-encoding.md)

97
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md 普通文件
查看文件

@@ -0,0 +1,97 @@
---
title: "Unexpected server crash in Next.js."
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2021-12-07T21:12:09Z"
updated_date: "2026-03-13T22:00:36.554552Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2021-43803"
- "GHSA-25mp-g6fv-mqxx"
affected_versions:
- "introduced=12.0.0, fixed<12.0.5"
- "introduced=0.9.9, fixed<11.1.3"
fixed_versions:
- "12.0.5"
- "11.1.3"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx"
---
# Unexpected server crash in Next.js.
## 事件层
- Canonical ID: `nextjs--CVE-2021-43803`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx
- 影响版本: `introduced=12.0.0, fixed<12.0.5, introduced=0.9.9, fixed<11.1.3`
- 修复版本: `12.0.5, 11.1.3`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2021-43803
- https://github.com/vercel/next.js/pull/32080
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v11.1.3
- https://github.com/vercel/next.js/releases/v12.0.5
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)

93
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md 普通文件
查看文件

@@ -0,0 +1,93 @@
---
title: "Next.js Server-Side Request Forgery in Server Actions"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2024-05-09T21:18:57Z"
updated_date: "2026-02-04T03:32:36.434669Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2024-34351"
- "GHSA-fr5h-rqp8-mj6g"
affected_versions:
- "introduced=13.4.0, fixed<14.1.1"
fixed_versions:
- "14.1.1"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "ssrf-url-validation"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g"
---
# Next.js Server-Side Request Forgery in Server Actions
## 事件层
- Canonical ID: `nextjs--CVE-2024-34351`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
- 影响版本: `introduced=13.4.0, fixed<14.1.1`
- 修复版本: `14.1.1`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2024-34351
- https://github.com/vercel/next.js/pull/62561
- https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
- https://github.com/vercel/next.js
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/javascript-typescript/ssrf-url-validation.md)
- [nodejs:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/nodejs/ssrf-url-validation.md)
- [java:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/java/ssrf-url-validation.md)
- [php:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/php/ssrf-url-validation.md)
- [python:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/python/ssrf-url-validation.md)
- [ruby:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/ruby/ssrf-url-validation.md)
- [csharp:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/csharp/ssrf-url-validation.md)
- [go:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/go/ssrf-url-validation.md)

86
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md 普通文件
查看文件

@@ -0,0 +1,86 @@
---
title: "Next.js Cache Poisoning"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2024-09-17T21:58:09Z"
updated_date: "2026-02-04T03:45:33.402195Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2024-46982"
- "GHSA-gp8f-8m3g-qvj9"
affected_versions:
- "introduced=13.5.1, fixed<13.5.7"
- "introduced=14.0.0, fixed<14.2.10"
fixed_versions:
- "13.5.7"
- "14.2.10"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9"
---
# Next.js Cache Poisoning
## 事件层
- Canonical ID: `nextjs--CVE-2024-46982`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
- 影响版本: `introduced=13.5.1, fixed<13.5.7, introduced=14.0.0, fixed<14.2.10`
- 修复版本: `13.5.7, 14.2.10`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2024-46982
- https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
- https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
- https://github.com/vercel/next.js
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

83
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md 普通文件
查看文件

@@ -0,0 +1,83 @@
---
title: "Denial of Service condition in Next.js image optimization"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2024-10-14T19:45:21Z"
updated_date: "2026-02-04T03:25:43.295558Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2024-47831"
- "GHSA-g77x-44xx-532m"
affected_versions:
- "introduced=10.0.0, fixed<14.2.7"
fixed_versions:
- "14.2.7"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m"
---
# Denial of Service condition in Next.js image optimization
## 事件层
- Canonical ID: `nextjs--CVE-2024-47831`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
- 影响版本: `introduced=10.0.0, fixed<14.2.7`
- 修复版本: `14.2.7`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2024-47831
- https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
- https://github.com/vercel/next.js
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

84
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md 普通文件
查看文件

@@ -0,0 +1,84 @@
---
title: "Next.js authorization bypass vulnerability"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2024-12-17T15:09:06Z"
updated_date: "2025-09-10T21:12:24Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2024-51479"
- "GHSA-7gfc-8cq8-jh5f"
affected_versions:
- "introduced=9.5.5, fixed<14.2.15"
fixed_versions:
- "14.2.15"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f"
---
# Next.js authorization bypass vulnerability
## 事件层
- Canonical ID: `nextjs--CVE-2024-51479`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
- 影响版本: `introduced=9.5.5, fixed<14.2.15`
- 修复版本: `14.2.15`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2024-51479
- https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v14.2.15
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

86
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md 普通文件
查看文件

@@ -0,0 +1,86 @@
---
title: "Next.js Allows a Denial of Service (DoS) with Server Actions"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-01-03T20:19:29Z"
updated_date: "2026-02-04T04:36:04.252972Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2024-56332"
- "GHSA-7m27-7ghc-44w9"
affected_versions:
- "introduced=13.0.0, fixed<13.5.8"
- "introduced=14.0.0, fixed<14.2.21"
- "introduced=15.0.0, fixed<15.1.2"
fixed_versions:
- "13.5.8"
- "14.2.21"
- "15.1.2"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9"
---
# Next.js Allows a Denial of Service (DoS) with Server Actions
## 事件层
- Canonical ID: `nextjs--CVE-2024-56332`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
- 影响版本: `introduced=13.0.0, fixed<13.5.8, introduced=14.0.0, fixed<14.2.21, introduced=15.0.0, fixed<15.1.2`
- 修复版本: `13.5.8, 14.2.21, 15.1.2`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2024-56332
- https://github.com/vercel/next.js
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

96
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md 普通文件
查看文件

@@ -0,0 +1,96 @@
---
title: "Authorization Bypass in Next.js Middleware"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-03-21T15:20:12Z"
updated_date: "2026-03-04T15:06:29.993197Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-29927"
- "GHSA-f82v-jwr5-mffw"
affected_versions:
- "introduced=13.0.0, fixed<13.5.9"
- "introduced=14.0.0, fixed<14.2.25"
- "introduced=15.0.0, fixed<15.2.3"
- "introduced=12.0.0, fixed<12.3.5"
fixed_versions:
- "13.5.9"
- "14.2.25"
- "15.2.3"
- "12.3.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw"
---
# Authorization Bypass in Next.js Middleware
## 事件层
- Canonical ID: `nextjs--CVE-2025-29927`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
- 影响版本: `introduced=13.0.0, fixed<13.5.9, introduced=14.0.0, fixed<14.2.25, introduced=15.0.0, fixed<15.2.3, introduced=12.0.0, fixed<12.3.5`
- 修复版本: `13.5.9, 14.2.25, 15.2.3, 12.3.5`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-29927
- https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
- https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v12.3.5
- https://github.com/vercel/next.js/releases/tag/v13.5.9
- https://security.netapp.com/advisory/ntap-20250328-0002
- https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
- http://www.openwall.com/lists/oss-security/2025/03/23/3
- http://www.openwall.com/lists/oss-security/2025/03/23/4
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

93
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md 普通文件
查看文件

@@ -0,0 +1,93 @@
---
title: "Next.js may leak x-middleware-subrequest-id to external hosts"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-04-02T22:35:37Z"
updated_date: "2025-10-13T15:35:50Z"
severity: "medium"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-30218"
- "GHSA-223j-4rm8-mrmf"
affected_versions:
- "12.3.5"
- "13.5.9"
- "14.2.25"
- "15.2.3"
- "introduced=12.3.5, fixed<12.3.6"
- "introduced=13.5.9, fixed<13.5.10"
- "introduced=14.2.25, fixed<14.2.26"
- "introduced=15.2.3, fixed<15.2.4"
fixed_versions:
- "12.3.6"
- "13.5.10"
- "14.2.26"
- "15.2.4"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf"
---
# Next.js may leak x-middleware-subrequest-id to external hosts
## 事件层
- Canonical ID: `nextjs--CVE-2025-30218`
- 系统: `nextjs`
- 严重度: `medium`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf
- 影响版本: `12.3.5, 13.5.9, 14.2.25, 15.2.3, introduced=12.3.5, fixed<12.3.6, introduced=13.5.9, fixed<13.5.10, introduced=14.2.25, fixed<14.2.26, introduced=15.2.3, fixed<15.2.4`
- 修复版本: `12.3.6, 13.5.10, 14.2.26, 15.2.4`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-30218
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

85
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md 普通文件
查看文件

@@ -0,0 +1,85 @@
---
title: "Next.js Race Condition to Cache Poisoning"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-05-15T14:12:26Z"
updated_date: "2025-09-26T17:48:29Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-32421"
- "GHSA-qpjv-v59x-3qc4"
affected_versions:
- "introduced=0.9.9, fixed<14.2.24"
- "introduced=15.0.0, fixed<15.1.6"
fixed_versions:
- "14.2.24"
- "15.1.6"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4"
---
# Next.js Race Condition to Cache Poisoning
## 事件层
- Canonical ID: `nextjs--CVE-2025-32421`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
- 影响版本: `introduced=0.9.9, fixed<14.2.24, introduced=15.0.0, fixed<15.1.6`
- 修复版本: `14.2.24, 15.1.6`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-32421
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-32421
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

85
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md 普通文件
查看文件

@@ -0,0 +1,85 @@
---
title: "Information exposure in Next.js dev server due to lack of origin verification"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-05-28T21:52:13Z"
updated_date: "2025-06-13T14:41:21Z"
severity: "medium"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-48068"
- "GHSA-3h52-269p-cp9r"
affected_versions:
- "introduced=15.0.0, fixed<15.2.2"
- "introduced=13.0, fixed<14.2.30"
fixed_versions:
- "15.2.2"
- "14.2.30"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r"
---
# Information exposure in Next.js dev server due to lack of origin verification
## 事件层
- Canonical ID: `nextjs--CVE-2025-48068`
- 系统: `nextjs`
- 严重度: `medium`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r
- 影响版本: `introduced=15.0.0, fixed<15.2.2, introduced=13.0, fixed<14.2.30`
- 修复版本: `15.2.2, 14.2.30`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-48068
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-48068
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

87
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md 普通文件
查看文件

@@ -0,0 +1,87 @@
---
title: "Next.js has a Cache poisoning vulnerability due to omission of the Vary header"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-07-03T20:30:18Z"
updated_date: "2026-02-04T02:37:18.974477Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-49005"
- "GHSA-r2fc-ccr8-96c4"
affected_versions:
- "introduced=15.3.0, fixed<15.3.3"
fixed_versions:
- "15.3.3"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4"
---
# Next.js has a Cache poisoning vulnerability due to omission of the Vary header
## 事件层
- Canonical ID: `nextjs--CVE-2025-49005`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
- 影响版本: `introduced=15.3.0, fixed<15.3.3`
- 修复版本: `15.3.3`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-49005
- https://github.com/vercel/next.js/issues/79346
- https://github.com/vercel/next.js/pull/79939
- https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.3.3
- https://vercel.com/changelog/cve-2025-49005
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

86
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md 普通文件
查看文件

@@ -0,0 +1,86 @@
---
title: "Next.JS vulnerability can lead to DoS via cache poisoning "
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-07-03T21:14:48Z"
updated_date: "2025-07-03T21:49:52Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-49826"
- "GHSA-67rr-84xm-4c7r"
affected_versions:
- "introduced=15.0.4-canary.51, fixed<15.1.8"
fixed_versions:
- "15.1.8"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r"
---
# Next.JS vulnerability can lead to DoS via cache poisoning
## 事件层
- Canonical ID: `nextjs--CVE-2025-49826`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
- 影响版本: `introduced=15.0.4-canary.51, fixed<15.1.8`
- 修复版本: `15.1.8`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-49826
- https://github.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2
- https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.1.8
- https://vercel.com/changelog/cve-2025-49826
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

87
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md 普通文件
查看文件

@@ -0,0 +1,87 @@
---
title: "Next.js Content Injection Vulnerability for Image Optimization"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-08-29T21:59:55Z"
updated_date: "2026-02-04T04:35:34.538107Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-55173"
- "GHSA-xv57-4mr9-wg8v"
affected_versions:
- "introduced=0.9.9, fixed<14.2.31"
- "introduced=15.0.0, fixed<15.4.5"
fixed_versions:
- "14.2.31"
- "15.4.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v"
---
# Next.js Content Injection Vulnerability for Image Optimization
## 事件层
- Canonical ID: `nextjs--CVE-2025-55173`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
- 影响版本: `introduced=0.9.9, fixed<14.2.31, introduced=15.0.0, fixed<15.4.5`
- 修复版本: `14.2.31, 15.4.5`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-55173
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-55173
- http://vercel.com/changelog/cve-2025-55173
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

87
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md 普通文件
查看文件

@@ -0,0 +1,87 @@
---
title: "Next.js Affected by Cache Key Confusion for Image Optimization API Routes"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-08-29T22:06:22Z"
updated_date: "2026-02-04T02:50:08.291668Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-57752"
- "GHSA-g5qg-72qw-gw5v"
affected_versions:
- "introduced=0.9.9, fixed<14.2.31"
- "introduced=15.0.0, fixed<15.4.5"
fixed_versions:
- "14.2.31"
- "15.4.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v"
---
# Next.js Affected by Cache Key Confusion for Image Optimization API Routes
## 事件层
- Canonical ID: `nextjs--CVE-2025-57752`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
- 影响版本: `introduced=0.9.9, fixed<14.2.31, introduced=15.0.0, fixed<15.4.5`
- 修复版本: `14.2.31, 15.4.5`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-57752
- https://github.com/vercel/next.js/pull/82114
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-57752
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

95
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md 普通文件
查看文件

@@ -0,0 +1,95 @@
---
title: "Next.js Improper Middleware Redirect Handling Leads to SSRF"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-08-29T21:33:09Z"
updated_date: "2026-02-04T04:20:45.658010Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-57822"
- "GHSA-4342-x723-ch2f"
affected_versions:
- "introduced=0.9.9, fixed<14.2.32"
- "introduced=15.0.0-canary.0, fixed<15.4.7"
fixed_versions:
- "14.2.32"
- "15.4.7"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "ssrf-url-validation"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f"
---
# Next.js Improper Middleware Redirect Handling Leads to SSRF
## 事件层
- Canonical ID: `nextjs--CVE-2025-57822`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
- 影响版本: `introduced=0.9.9, fixed<14.2.32, introduced=15.0.0-canary.0, fixed<15.4.7`
- 修复版本: `14.2.32, 15.4.7`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-57822
- https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-57822
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/javascript-typescript/ssrf-url-validation.md)
- [nodejs:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/nodejs/ssrf-url-validation.md)
- [java:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/java/ssrf-url-validation.md)
- [php:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/php/ssrf-url-validation.md)
- [python:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/python/ssrf-url-validation.md)
- [ruby:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/ruby/ssrf-url-validation.md)
- [csharp:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/csharp/ssrf-url-validation.md)
- [go:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/go/ssrf-url-validation.md)

88
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md 普通文件
查看文件

@@ -0,0 +1,88 @@
---
title: "Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2026-01-27T19:18:25Z"
updated_date: "2026-02-10T01:28:46.973023Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-59471"
- "GHSA-9g9p-9gw9-jx7f"
affected_versions:
- "introduced=10.0.0, fixed<15.5.10"
- "introduced=15.6.0-canary.0, fixed<16.1.5"
fixed_versions:
- "15.5.10"
- "16.1.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f"
---
# Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
## 事件层
- Canonical ID: `nextjs--CVE-2025-59471`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
- 影响版本: `introduced=10.0.0, fixed<15.5.10, introduced=15.6.0-canary.0, fixed<16.1.5`
- 修复版本: `15.5.10, 16.1.5`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-59471
- https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
- https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.10
- https://github.com/vercel/next.js/releases/tag/v16.1.5
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

85
07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md 普通文件
查看文件

@@ -0,0 +1,85 @@
---
title: "Next.js has Unbounded Memory Consumption via PPR Resume Endpoint "
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2026-01-28T15:20:55Z"
updated_date: "2026-02-06T13:13:43.709252Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "CVE-2025-59472"
- "GHSA-5f7q-jpqc-wp7h"
affected_versions:
- "introduced=15.0.0-canary.0, fixed<15.6.0-canary.61"
- "introduced=16.0.0-beta.0, fixed<16.1.5"
fixed_versions:
- "15.6.0-canary.61"
- "16.1.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"
---
# Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
## 事件层
- Canonical ID: `nextjs--CVE-2025-59472`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
- 影响版本: `introduced=15.0.0-canary.0, fixed<15.6.0-canary.61, introduced=16.0.0-beta.0, fixed<16.1.5`
- 修复版本: `15.6.0-canary.61, 16.1.5`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-59472
- https://github.com/vercel/next.js
- https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

103
07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md 普通文件
查看文件

@@ -0,0 +1,103 @@
---
title: "Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-12-12T17:21:57Z"
updated_date: "2026-02-04T02:46:38.768104Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "GHSA-5j59-xgg2-r9c4"
affected_versions:
- "introduced=13.3.1-canary.0, fixed<14.2.35"
- "introduced=15.0.6, fixed<15.0.7"
- "introduced=15.1.10, fixed<15.1.11"
- "introduced=15.2.7, fixed<15.2.8"
- "introduced=15.3.7, fixed<15.3.8"
- "introduced=15.4.9, fixed<15.4.10"
- "introduced=15.5.8, fixed<15.5.9"
- "introduced=15.6.0-canary.59, fixed<15.6.0-canary.60"
- "introduced=16.0.9, fixed<16.0.10"
- "introduced=16.1.0-canary.17, fixed<16.1.0-canary.19"
fixed_versions:
- "14.2.35"
- "15.0.7"
- "15.1.11"
- "15.2.8"
- "15.3.8"
- "15.4.10"
- "15.5.9"
- "15.6.0-canary.60"
- "16.0.10"
- "16.1.0-canary.19"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4"
---
# Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
## 事件层
- Canonical ID: `nextjs--GHSA-5j59-xgg2-r9c4`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
- 影响版本: `introduced=13.3.1-canary.0, fixed<14.2.35, introduced=15.0.6, fixed<15.0.7, introduced=15.1.10, fixed<15.1.11, introduced=15.2.7, fixed<15.2.8, introduced=15.3.7, fixed<15.3.8, introduced=15.4.9, fixed<15.4.10, introduced=15.5.8, fixed<15.5.9, introduced=15.6.0-canary.59, fixed<15.6.0-canary.60, introduced=16.0.9, fixed<16.0.10, introduced=16.1.0-canary.17, fixed<16.1.0-canary.19`
- 修复版本: `14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19`
## 其他来源
- https://nvd.nist.gov/vuln/detail/CVE-2025-67779
- https://github.com/vercel/next.js
- https://nextjs.org/blog/security-update-2025-12-11
- https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
- https://www.cve.org/CVERecord?id=CVE-2025-55184
- https://www.facebook.com/security/advisories/cve-2025-67779
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)

104
07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md 普通文件
查看文件

@@ -0,0 +1,104 @@
---
title: "Next.js is vulnerable to RCE in React flight protocol"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-12-03T19:07:11Z"
updated_date: "2026-02-04T03:45:15.823345Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "GHSA-9qr9-h5gf-34mp"
affected_versions:
- "introduced=14.3.0-canary.77, fixed<15.0.5"
- "introduced=15.1.0-canary.0, fixed<15.1.9"
- "introduced=15.2.0-canary.0, fixed<15.2.6"
- "introduced=15.3.0-canary.0, fixed<15.3.6"
- "introduced=15.4.0-canary.0, fixed<15.4.8"
- "introduced=15.5.0-canary.0, fixed<15.5.7"
- "introduced=16.0.0-canary.0, fixed<16.0.7"
fixed_versions:
- "15.0.5"
- "15.1.9"
- "15.2.6"
- "15.3.6"
- "15.4.8"
- "15.5.7"
- "16.0.7"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
primary_source: "https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r"
---
# Next.js is vulnerable to RCE in React flight protocol
## 事件层
- Canonical ID: `nextjs--GHSA-9qr9-h5gf-34mp`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
- 影响版本: `introduced=14.3.0-canary.77, fixed<15.0.5, introduced=15.1.0-canary.0, fixed<15.1.9, introduced=15.2.0-canary.0, fixed<15.2.6, introduced=15.3.0-canary.0, fixed<15.3.6, introduced=15.4.0-canary.0, fixed<15.4.8, introduced=15.5.0-canary.0, fixed<15.5.7, introduced=16.0.0-canary.0, fixed<16.0.7`
- 修复版本: `15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7`
## 其他来源
- https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
- https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://github.com/vercel/next.js
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)

117
07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md 普通文件
查看文件

@@ -0,0 +1,117 @@
---
title: "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2026-01-28T15:38:01Z"
updated_date: "2026-02-13T00:43:52.836085Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "GHSA-h25m-26qc-wcjf"
affected_versions:
- "introduced=13.0.0, fixed<15.0.8"
- "introduced=15.1.1-canary.0, fixed<15.1.12"
- "introduced=15.2.0-canary.0, fixed<15.2.9"
- "introduced=15.3.0-canary.0, fixed<15.3.9"
- "introduced=15.4.0-canary.0, fixed<15.4.11"
- "introduced=15.5.1-canary.0, fixed<15.5.10"
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.61"
- "introduced=16.0.0-beta.0, fixed<16.0.11"
- "introduced=16.1.0-canary.0, fixed<16.1.5"
fixed_versions:
- "15.0.8"
- "15.1.12"
- "15.2.9"
- "15.3.9"
- "15.4.11"
- "15.5.10"
- "15.6.0-canary.61"
- "16.0.11"
- "16.1.5"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
- "deserialization-safety"
primary_source: "https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg"
---
# Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
## 事件层
- Canonical ID: `nextjs--GHSA-h25m-26qc-wcjf`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
- 影响版本: `introduced=13.0.0, fixed<15.0.8, introduced=15.1.1-canary.0, fixed<15.1.12, introduced=15.2.0-canary.0, fixed<15.2.9, introduced=15.3.0-canary.0, fixed<15.3.9, introduced=15.4.0-canary.0, fixed<15.4.11, introduced=15.5.1-canary.0, fixed<15.5.10, introduced=15.6.0-canary.0, fixed<15.6.0-canary.61, introduced=16.0.0-beta.0, fixed<16.0.11, introduced=16.1.0-canary.0, fixed<16.1.5`
- 修复版本: `15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5`
## 其他来源
- https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
- https://nvd.nist.gov/vuln/detail/CVE-2026-23864
- https://github.com/vercel/next.js
- https://vercel.com/changelog/summary-of-cve-2026-23864
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
- [javascript-typescript:deserialization-safety](/Users/x/websafe/05-defense/secure-code/javascript-typescript/deserialization-safety.md)
- [nodejs:deserialization-safety](/Users/x/websafe/05-defense/secure-code/nodejs/deserialization-safety.md)
- [java:deserialization-safety](/Users/x/websafe/05-defense/secure-code/java/deserialization-safety.md)
- [php:deserialization-safety](/Users/x/websafe/05-defense/secure-code/php/deserialization-safety.md)
- [python:deserialization-safety](/Users/x/websafe/05-defense/secure-code/python/deserialization-safety.md)
- [ruby:deserialization-safety](/Users/x/websafe/05-defense/secure-code/ruby/deserialization-safety.md)
- [csharp:deserialization-safety](/Users/x/websafe/05-defense/secure-code/csharp/deserialization-safety.md)
- [go:deserialization-safety](/Users/x/websafe/05-defense/secure-code/go/deserialization-safety.md)

109
07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md 普通文件
查看文件

@@ -0,0 +1,109 @@
---
title: "Next Vulnerable to Denial of Service with Server Components"
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-12-11T22:49:27Z"
updated_date: "2026-02-04T03:55:54.855562Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "GHSA-mwv6-3258-q52c"
affected_versions:
- "introduced=13.3.0, fixed<14.2.34"
- "introduced=15.0.0-canary.0, fixed<15.0.6"
- "introduced=15.1.1-canary.0, fixed<15.1.10"
- "introduced=15.2.0-canary.0, fixed<15.2.7"
- "introduced=15.3.0-canary.0, fixed<15.3.7"
- "introduced=15.4.0-canary.0, fixed<15.4.9"
- "introduced=15.5.1-canary.0, fixed<15.5.8"
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.59"
- "introduced=16.0.0-beta.0, fixed<16.0.9"
- "introduced=16.1.0-canary.0, fixed<16.1.0-canary.17"
fixed_versions:
- "14.2.34"
- "15.0.6"
- "15.1.10"
- "15.2.7"
- "15.3.7"
- "15.4.9"
- "15.5.8"
- "15.6.0-canary.59"
- "16.0.9"
- "16.1.0-canary.17"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c"
---
# Next Vulnerable to Denial of Service with Server Components
## 事件层
- Canonical ID: `nextjs--GHSA-mwv6-3258-q52c`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
- 影响版本: `introduced=13.3.0, fixed<14.2.34, introduced=15.0.0-canary.0, fixed<15.0.6, introduced=15.1.1-canary.0, fixed<15.1.10, introduced=15.2.0-canary.0, fixed<15.2.7, introduced=15.3.0-canary.0, fixed<15.3.7, introduced=15.4.0-canary.0, fixed<15.4.9, introduced=15.5.1-canary.0, fixed<15.5.8, introduced=15.6.0-canary.0, fixed<15.6.0-canary.59, introduced=16.0.0-beta.0, fixed<16.0.9, introduced=16.1.0-canary.0, fixed<16.1.0-canary.17`
- 修复版本: `14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17`
## 其他来源
- https://github.com/vercel/next.js
- https://nextjs.org/blog/security-update-2025-12-11
- https://www.cve.org/CVERecord?id=CVE-2025-55184
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)

107
07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md 普通文件
查看文件

@@ -0,0 +1,107 @@
---
title: "Next Server Actions Source Code Exposure "
system_id: "nextjs"
category: "frameworks"
advisory_mode: "core"
published_date: "2025-12-11T22:49:56Z"
updated_date: "2026-02-04T02:51:40.627151Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
target_types:
- "lab-local"
- "lab-public"
- "authorized-third-party"
allow_public_validation: "yes, with ownership or explicit authorization"
authorization_prerequisite: "asset ownership proof or explicit written authorization"
minimal_validation: "read-only probe, controlled payload, reversible test"
aliases:
- "GHSA-w37m-7fhw-fmv9"
affected_versions:
- "introduced=15.0.0-canary.0, fixed<15.0.6"
- "introduced=15.1.1-canary.0, fixed<15.1.10"
- "introduced=15.2.0-canary.0, fixed<15.2.7"
- "introduced=15.3.0-canary.0, fixed<15.3.7"
- "introduced=15.4.0-canary.0, fixed<15.4.9"
- "introduced=15.5.1-canary.0, fixed<15.5.8"
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.59"
- "introduced=16.0.0-beta.0, fixed<16.0.9"
- "introduced=16.1.0-canary.0, fixed<16.1.0-canary.17"
fixed_versions:
- "15.0.6"
- "15.1.10"
- "15.2.7"
- "15.3.7"
- "15.4.9"
- "15.5.8"
- "15.6.0-canary.59"
- "16.0.9"
- "16.1.0-canary.17"
secure_code_topics:
- "authz-server-side-recheck"
- "proxy-trust-boundary"
- "token-cookie-storage"
- "dependency-upgrade-policy"
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9"
---
# Next Server Actions Source Code Exposure
## 事件层
- Canonical ID: `nextjs--GHSA-w37m-7fhw-fmv9`
- 系统: `nextjs`
- 严重度: `low`
- 来源置信度: `official`
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
- 影响版本: `introduced=15.0.0-canary.0, fixed<15.0.6, introduced=15.1.1-canary.0, fixed<15.1.10, introduced=15.2.0-canary.0, fixed<15.2.7, introduced=15.3.0-canary.0, fixed<15.3.7, introduced=15.4.0-canary.0, fixed<15.4.9, introduced=15.5.1-canary.0, fixed<15.5.8, introduced=15.6.0-canary.0, fixed<15.6.0-canary.59, introduced=16.0.0-beta.0, fixed<16.0.9, introduced=16.1.0-canary.0, fixed<16.1.0-canary.17`
- 修复版本: `15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17`
## 其他来源
- https://github.com/vercel/next.js
- https://nextjs.org/blog/security-update-2025-12-11
- https://www.cve.org/CVERecord?id=CVE-2025-55183
## 实验层
- 仅用于自有资产、测试环境或已明确授权目标。
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 修复示例
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)

30
07-framework-security/frameworks/nodejs/INDEX.md 普通文件
查看文件

@@ -0,0 +1,30 @@
# Node.js
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `nodejs`
- 分类: `frameworks`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability) (mode=core)
- `official` [CISA KEV Node.js](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/nodejs/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Node.js
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `history-full`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/nodejs`
- 修复主题: ssrf-url-validation, request-smuggling-boundary, dependency-upgrade-policy
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/nodejs/INDEX.md)
- Registry 统计: [nodejs.json](/Users/x/websafe/08-threat-intel/registry/systems/nodejs.json)

31
07-framework-security/frameworks/nuxt/INDEX.md 普通文件
查看文件

@@ -0,0 +1,31 @@
# Nuxt
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY` | 自动生成索引
- 系统 ID: `nuxt`
- 分类: `frameworks`
- 覆盖策略: `history-full`
- 总案例数: `0`
- 近 30 天新增/更新: `0`
- 重点 Markdown 案例数: `0`
- 最近渲染时间: `2026-03-17T04:37:52+00:00`
## 目标约束
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but ownership or authorization is required`
- 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
## 来源
- `official` [Nuxt Security](https://github.com/nuxt/nuxt/security/advisories) (mode=core)
- `official` [GitHub Global Advisories](https://github.com/advisories) (ecosystem=npm; mode=core)
- `official` [OSV Nuxt](https://osv.dev/) (mode=core)
## 案例列表
| 标题 | 严重度 | 状态 | 来源置信度 | 更新时间 | 案例页 |
|------|--------|------|------------|----------|--------|
| No advisories yet | `n/a` | `empty` | `n/a` | `n/a` | - |

16
07-framework-security/frameworks/nuxt/README.md 普通文件
查看文件

@@ -0,0 +1,16 @@
# Nuxt
> `LAB ONLY` | `AUTHORIZED TARGETS ONLY`
- 分类: `frameworks`
- 覆盖层级: `history-full`
- Advisory 模式: core
- 输出目录: `07-framework-security/frameworks/nuxt`
- 修复主题: authz-server-side-recheck, proxy-trust-boundary, token-cookie-storage
- 适用目标类型: `lab-local, lab-public, authorized-third-party`
- 是否允许公网验证: `yes, but only for owned or authorized targets`
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
- 自动索引: [INDEX.md](/Users/x/websafe/07-framework-security/frameworks/nuxt/INDEX.md)
- Registry 统计: [nuxt.json](/Users/x/websafe/08-threat-intel/registry/systems/nuxt.json)

某些文件未显示，因为此 diff 中更改的文件太多 显示更多