kb: expand authorized lab coverage and intel automation
这个提交包含在：
hao
@@ -0,0 +1,83 @@
|
||||
---
|
||||
title: "Open Redirect in Next.js versions"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2020-10-08T19:28:07Z"
|
||||
updated_date: "2026-03-13T22:14:13.665535Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2020-15242"
|
||||
- "GHSA-x56p-c8cg-q435"
|
||||
affected_versions:
|
||||
- "introduced=9.5.0, fixed<9.5.4"
|
||||
fixed_versions:
|
||||
- "9.5.4"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435"
|
||||
---
|
||||
|
||||
# Open Redirect in Next.js versions
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2020-15242`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
|
||||
- 影响版本: `introduced=9.5.0, fixed<9.5.4`
|
||||
- 修复版本: `9.5.4`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2020-15242
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/zeit/next.js/releases/tag/v9.5.4
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
title: "Directory Traversal in Next.js"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2020-03-30T20:40:50Z"
|
||||
updated_date: "2025-09-26T17:49:56Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2020-5284"
|
||||
- "GHSA-fq77-7p7r-83rj"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<9.3.2"
|
||||
fixed_versions:
|
||||
- "9.3.2"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "path-traversal-guard"
|
||||
primary_source: "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
|
||||
---
|
||||
|
||||
# Directory Traversal in Next.js
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2020-5284`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
|
||||
- 影响版本: `introduced=0.9.9, fixed<9.3.2`
|
||||
- 修复版本: `9.3.2`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2020-5284
|
||||
- https://github.com/zeit/next.js/releases/tag/v9.3.2
|
||||
- https://www.npmjs.com/advisories/1503
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/javascript-typescript/path-traversal-guard.md)
|
||||
- [nodejs:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/nodejs/path-traversal-guard.md)
|
||||
- [java:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/java/path-traversal-guard.md)
|
||||
- [php:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/php/path-traversal-guard.md)
|
||||
- [python:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/python/path-traversal-guard.md)
|
||||
- [ruby:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/ruby/path-traversal-guard.md)
|
||||
- [csharp:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/csharp/path-traversal-guard.md)
|
||||
- [go:path-traversal-guard](/Users/x/websafe/05-defense/secure-code/go/path-traversal-guard.md)
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
title: "Open Redirect in Next.js"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2021-08-12T14:51:14Z"
|
||||
updated_date: "2026-03-13T22:00:08.038285Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2021-37699"
|
||||
- "GHSA-vxf5-wxwp-m7g9"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<11.1.0"
|
||||
fixed_versions:
|
||||
- "11.1.0"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9"
|
||||
---
|
||||
|
||||
# Open Redirect in Next.js
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2021-37699`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9
|
||||
- 影响版本: `introduced=0.9.9, fixed<11.1.0`
|
||||
- 修复版本: `11.1.0`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-37699
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v11.1.0
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
title: "XSS in Image Optimization API for Next.js"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2021-09-01T18:24:22Z"
|
||||
updated_date: "2026-03-13T22:00:20.154452Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2021-39178"
|
||||
- "GHSA-9gr3-7897-pp7m"
|
||||
affected_versions:
|
||||
- "introduced=10.0.0, fixed<11.1.1"
|
||||
fixed_versions:
|
||||
- "11.1.1"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "xss-output-encoding"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m"
|
||||
---
|
||||
|
||||
# XSS in Image Optimization API for Next.js
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2021-39178`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
|
||||
- 影响版本: `introduced=10.0.0, fixed<11.1.1`
|
||||
- 修复版本: `11.1.1`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-39178
|
||||
- https://github.com/vercel/next.js/pull/28620
|
||||
- https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v11.1.1
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/javascript-typescript/xss-output-encoding.md)
|
||||
- [nodejs:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/nodejs/xss-output-encoding.md)
|
||||
- [java:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/java/xss-output-encoding.md)
|
||||
- [php:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/php/xss-output-encoding.md)
|
||||
- [python:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/python/xss-output-encoding.md)
|
||||
- [ruby:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/ruby/xss-output-encoding.md)
|
||||
- [csharp:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/csharp/xss-output-encoding.md)
|
||||
- [go:xss-output-encoding](/Users/x/websafe/05-defense/secure-code/go/xss-output-encoding.md)
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
title: "Unexpected server crash in Next.js."
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2021-12-07T21:12:09Z"
|
||||
updated_date: "2026-03-13T22:00:36.554552Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2021-43803"
|
||||
- "GHSA-25mp-g6fv-mqxx"
|
||||
affected_versions:
|
||||
- "introduced=12.0.0, fixed<12.0.5"
|
||||
- "introduced=0.9.9, fixed<11.1.3"
|
||||
fixed_versions:
|
||||
- "12.0.5"
|
||||
- "11.1.3"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx"
|
||||
---
|
||||
|
||||
# Unexpected server crash in Next.js.
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2021-43803`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx
|
||||
- 影响版本: `introduced=12.0.0, fixed<12.0.5, introduced=0.9.9, fixed<11.1.3`
|
||||
- 修复版本: `12.0.5, 11.1.3`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-43803
|
||||
- https://github.com/vercel/next.js/pull/32080
|
||||
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v11.1.3
|
||||
- https://github.com/vercel/next.js/releases/v12.0.5
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
@@ -0,0 +1,93 @@
|
||||
---
|
||||
title: "Next.js Server-Side Request Forgery in Server Actions"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2024-05-09T21:18:57Z"
|
||||
updated_date: "2026-02-04T03:32:36.434669Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2024-34351"
|
||||
- "GHSA-fr5h-rqp8-mj6g"
|
||||
affected_versions:
|
||||
- "introduced=13.4.0, fixed<14.1.1"
|
||||
fixed_versions:
|
||||
- "14.1.1"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "ssrf-url-validation"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g"
|
||||
---
|
||||
|
||||
# Next.js Server-Side Request Forgery in Server Actions
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2024-34351`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
|
||||
- 影响版本: `introduced=13.4.0, fixed<14.1.1`
|
||||
- 修复版本: `14.1.1`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-34351
|
||||
- https://github.com/vercel/next.js/pull/62561
|
||||
- https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
|
||||
- https://github.com/vercel/next.js
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/javascript-typescript/ssrf-url-validation.md)
|
||||
- [nodejs:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/nodejs/ssrf-url-validation.md)
|
||||
- [java:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/java/ssrf-url-validation.md)
|
||||
- [php:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/php/ssrf-url-validation.md)
|
||||
- [python:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/python/ssrf-url-validation.md)
|
||||
- [ruby:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/ruby/ssrf-url-validation.md)
|
||||
- [csharp:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/csharp/ssrf-url-validation.md)
|
||||
- [go:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/go/ssrf-url-validation.md)
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
title: "Next.js Cache Poisoning"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2024-09-17T21:58:09Z"
|
||||
updated_date: "2026-02-04T03:45:33.402195Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2024-46982"
|
||||
- "GHSA-gp8f-8m3g-qvj9"
|
||||
affected_versions:
|
||||
- "introduced=13.5.1, fixed<13.5.7"
|
||||
- "introduced=14.0.0, fixed<14.2.10"
|
||||
fixed_versions:
|
||||
- "13.5.7"
|
||||
- "14.2.10"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9"
|
||||
---
|
||||
|
||||
# Next.js Cache Poisoning
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2024-46982`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
|
||||
- 影响版本: `introduced=13.5.1, fixed<13.5.7, introduced=14.0.0, fixed<14.2.10`
|
||||
- 修复版本: `13.5.7, 14.2.10`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-46982
|
||||
- https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
|
||||
- https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
|
||||
- https://github.com/vercel/next.js
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,83 @@
|
||||
---
|
||||
title: "Denial of Service condition in Next.js image optimization"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2024-10-14T19:45:21Z"
|
||||
updated_date: "2026-02-04T03:25:43.295558Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2024-47831"
|
||||
- "GHSA-g77x-44xx-532m"
|
||||
affected_versions:
|
||||
- "introduced=10.0.0, fixed<14.2.7"
|
||||
fixed_versions:
|
||||
- "14.2.7"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m"
|
||||
---
|
||||
|
||||
# Denial of Service condition in Next.js image optimization
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2024-47831`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
|
||||
- 影响版本: `introduced=10.0.0, fixed<14.2.7`
|
||||
- 修复版本: `14.2.7`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-47831
|
||||
- https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
|
||||
- https://github.com/vercel/next.js
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
title: "Next.js authorization bypass vulnerability"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2024-12-17T15:09:06Z"
|
||||
updated_date: "2025-09-10T21:12:24Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2024-51479"
|
||||
- "GHSA-7gfc-8cq8-jh5f"
|
||||
affected_versions:
|
||||
- "introduced=9.5.5, fixed<14.2.15"
|
||||
fixed_versions:
|
||||
- "14.2.15"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f"
|
||||
---
|
||||
|
||||
# Next.js authorization bypass vulnerability
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2024-51479`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
|
||||
- 影响版本: `introduced=9.5.5, fixed<14.2.15`
|
||||
- 修复版本: `14.2.15`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-51479
|
||||
- https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v14.2.15
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
title: "Next.js Allows a Denial of Service (DoS) with Server Actions"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-01-03T20:19:29Z"
|
||||
updated_date: "2026-02-04T04:36:04.252972Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2024-56332"
|
||||
- "GHSA-7m27-7ghc-44w9"
|
||||
affected_versions:
|
||||
- "introduced=13.0.0, fixed<13.5.8"
|
||||
- "introduced=14.0.0, fixed<14.2.21"
|
||||
- "introduced=15.0.0, fixed<15.1.2"
|
||||
fixed_versions:
|
||||
- "13.5.8"
|
||||
- "14.2.21"
|
||||
- "15.1.2"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9"
|
||||
---
|
||||
|
||||
# Next.js Allows a Denial of Service (DoS) with Server Actions
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2024-56332`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
|
||||
- 影响版本: `introduced=13.0.0, fixed<13.5.8, introduced=14.0.0, fixed<14.2.21, introduced=15.0.0, fixed<15.1.2`
|
||||
- 修复版本: `13.5.8, 14.2.21, 15.1.2`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-56332
|
||||
- https://github.com/vercel/next.js
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
title: "Authorization Bypass in Next.js Middleware"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-03-21T15:20:12Z"
|
||||
updated_date: "2026-03-04T15:06:29.993197Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-29927"
|
||||
- "GHSA-f82v-jwr5-mffw"
|
||||
affected_versions:
|
||||
- "introduced=13.0.0, fixed<13.5.9"
|
||||
- "introduced=14.0.0, fixed<14.2.25"
|
||||
- "introduced=15.0.0, fixed<15.2.3"
|
||||
- "introduced=12.0.0, fixed<12.3.5"
|
||||
fixed_versions:
|
||||
- "13.5.9"
|
||||
- "14.2.25"
|
||||
- "15.2.3"
|
||||
- "12.3.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw"
|
||||
---
|
||||
|
||||
# Authorization Bypass in Next.js Middleware
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-29927`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
|
||||
- 影响版本: `introduced=13.0.0, fixed<13.5.9, introduced=14.0.0, fixed<14.2.25, introduced=15.0.0, fixed<15.2.3, introduced=12.0.0, fixed<12.3.5`
|
||||
- 修复版本: `13.5.9, 14.2.25, 15.2.3, 12.3.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-29927
|
||||
- https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
|
||||
- https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v12.3.5
|
||||
- https://github.com/vercel/next.js/releases/tag/v13.5.9
|
||||
- https://security.netapp.com/advisory/ntap-20250328-0002
|
||||
- https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
|
||||
- http://www.openwall.com/lists/oss-security/2025/03/23/3
|
||||
- http://www.openwall.com/lists/oss-security/2025/03/23/4
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,93 @@
|
||||
---
|
||||
title: "Next.js may leak x-middleware-subrequest-id to external hosts"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-04-02T22:35:37Z"
|
||||
updated_date: "2025-10-13T15:35:50Z"
|
||||
severity: "medium"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-30218"
|
||||
- "GHSA-223j-4rm8-mrmf"
|
||||
affected_versions:
|
||||
- "12.3.5"
|
||||
- "13.5.9"
|
||||
- "14.2.25"
|
||||
- "15.2.3"
|
||||
- "introduced=12.3.5, fixed<12.3.6"
|
||||
- "introduced=13.5.9, fixed<13.5.10"
|
||||
- "introduced=14.2.25, fixed<14.2.26"
|
||||
- "introduced=15.2.3, fixed<15.2.4"
|
||||
fixed_versions:
|
||||
- "12.3.6"
|
||||
- "13.5.10"
|
||||
- "14.2.26"
|
||||
- "15.2.4"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf"
|
||||
---
|
||||
|
||||
# Next.js may leak x-middleware-subrequest-id to external hosts
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-30218`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `medium`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf
|
||||
- 影响版本: `12.3.5, 13.5.9, 14.2.25, 15.2.3, introduced=12.3.5, fixed<12.3.6, introduced=13.5.9, fixed<13.5.10, introduced=14.2.25, fixed<14.2.26, introduced=15.2.3, fixed<15.2.4`
|
||||
- 修复版本: `12.3.6, 13.5.10, 14.2.26, 15.2.4`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-30218
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
title: "Next.js Race Condition to Cache Poisoning"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-05-15T14:12:26Z"
|
||||
updated_date: "2025-09-26T17:48:29Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-32421"
|
||||
- "GHSA-qpjv-v59x-3qc4"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<14.2.24"
|
||||
- "introduced=15.0.0, fixed<15.1.6"
|
||||
fixed_versions:
|
||||
- "14.2.24"
|
||||
- "15.1.6"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4"
|
||||
---
|
||||
|
||||
# Next.js Race Condition to Cache Poisoning
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-32421`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
|
||||
- 影响版本: `introduced=0.9.9, fixed<14.2.24, introduced=15.0.0, fixed<15.1.6`
|
||||
- 修复版本: `14.2.24, 15.1.6`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-32421
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-32421
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
title: "Information exposure in Next.js dev server due to lack of origin verification"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-05-28T21:52:13Z"
|
||||
updated_date: "2025-06-13T14:41:21Z"
|
||||
severity: "medium"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-48068"
|
||||
- "GHSA-3h52-269p-cp9r"
|
||||
affected_versions:
|
||||
- "introduced=15.0.0, fixed<15.2.2"
|
||||
- "introduced=13.0, fixed<14.2.30"
|
||||
fixed_versions:
|
||||
- "15.2.2"
|
||||
- "14.2.30"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r"
|
||||
---
|
||||
|
||||
# Information exposure in Next.js dev server due to lack of origin verification
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-48068`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `medium`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r
|
||||
- 影响版本: `introduced=15.0.0, fixed<15.2.2, introduced=13.0, fixed<14.2.30`
|
||||
- 修复版本: `15.2.2, 14.2.30`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-48068
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-48068
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,87 @@
|
||||
---
|
||||
title: "Next.js has a Cache poisoning vulnerability due to omission of the Vary header"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-07-03T20:30:18Z"
|
||||
updated_date: "2026-02-04T02:37:18.974477Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-49005"
|
||||
- "GHSA-r2fc-ccr8-96c4"
|
||||
affected_versions:
|
||||
- "introduced=15.3.0, fixed<15.3.3"
|
||||
fixed_versions:
|
||||
- "15.3.3"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4"
|
||||
---
|
||||
|
||||
# Next.js has a Cache poisoning vulnerability due to omission of the Vary header
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-49005`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-r2fc-ccr8-96c4
|
||||
- 影响版本: `introduced=15.3.0, fixed<15.3.3`
|
||||
- 修复版本: `15.3.3`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-49005
|
||||
- https://github.com/vercel/next.js/issues/79346
|
||||
- https://github.com/vercel/next.js/pull/79939
|
||||
- https://github.com/vercel/next.js/commit/ec202eccf05820b60c6126d6411fe16766ecc066
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v15.3.3
|
||||
- https://vercel.com/changelog/cve-2025-49005
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
title: "Next.JS vulnerability can lead to DoS via cache poisoning "
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-07-03T21:14:48Z"
|
||||
updated_date: "2025-07-03T21:49:52Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-49826"
|
||||
- "GHSA-67rr-84xm-4c7r"
|
||||
affected_versions:
|
||||
- "introduced=15.0.4-canary.51, fixed<15.1.8"
|
||||
fixed_versions:
|
||||
- "15.1.8"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r"
|
||||
---
|
||||
|
||||
# Next.JS vulnerability can lead to DoS via cache poisoning
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-49826`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
|
||||
- 影响版本: `introduced=15.0.4-canary.51, fixed<15.1.8`
|
||||
- 修复版本: `15.1.8`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-49826
|
||||
- https://github.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2
|
||||
- https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v15.1.8
|
||||
- https://vercel.com/changelog/cve-2025-49826
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,87 @@
|
||||
---
|
||||
title: "Next.js Content Injection Vulnerability for Image Optimization"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-08-29T21:59:55Z"
|
||||
updated_date: "2026-02-04T04:35:34.538107Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-55173"
|
||||
- "GHSA-xv57-4mr9-wg8v"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<14.2.31"
|
||||
- "introduced=15.0.0, fixed<15.4.5"
|
||||
fixed_versions:
|
||||
- "14.2.31"
|
||||
- "15.4.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v"
|
||||
---
|
||||
|
||||
# Next.js Content Injection Vulnerability for Image Optimization
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-55173`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
|
||||
- 影响版本: `introduced=0.9.9, fixed<14.2.31, introduced=15.0.0, fixed<15.4.5`
|
||||
- 修复版本: `14.2.31, 15.4.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-55173
|
||||
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-55173
|
||||
- http://vercel.com/changelog/cve-2025-55173
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,87 @@
|
||||
---
|
||||
title: "Next.js Affected by Cache Key Confusion for Image Optimization API Routes"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-08-29T22:06:22Z"
|
||||
updated_date: "2026-02-04T02:50:08.291668Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-57752"
|
||||
- "GHSA-g5qg-72qw-gw5v"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<14.2.31"
|
||||
- "introduced=15.0.0, fixed<15.4.5"
|
||||
fixed_versions:
|
||||
- "14.2.31"
|
||||
- "15.4.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v"
|
||||
---
|
||||
|
||||
# Next.js Affected by Cache Key Confusion for Image Optimization API Routes
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-57752`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
|
||||
- 影响版本: `introduced=0.9.9, fixed<14.2.31, introduced=15.0.0, fixed<15.4.5`
|
||||
- 修复版本: `14.2.31, 15.4.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-57752
|
||||
- https://github.com/vercel/next.js/pull/82114
|
||||
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-57752
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,95 @@
|
||||
---
|
||||
title: "Next.js Improper Middleware Redirect Handling Leads to SSRF"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-08-29T21:33:09Z"
|
||||
updated_date: "2026-02-04T04:20:45.658010Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-57822"
|
||||
- "GHSA-4342-x723-ch2f"
|
||||
affected_versions:
|
||||
- "introduced=0.9.9, fixed<14.2.32"
|
||||
- "introduced=15.0.0-canary.0, fixed<15.4.7"
|
||||
fixed_versions:
|
||||
- "14.2.32"
|
||||
- "15.4.7"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "ssrf-url-validation"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f"
|
||||
---
|
||||
|
||||
# Next.js Improper Middleware Redirect Handling Leads to SSRF
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-57822`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
|
||||
- 影响版本: `introduced=0.9.9, fixed<14.2.32, introduced=15.0.0-canary.0, fixed<15.4.7`
|
||||
- 修复版本: `14.2.32, 15.4.7`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-57822
|
||||
- https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/cve-2025-57822
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/javascript-typescript/ssrf-url-validation.md)
|
||||
- [nodejs:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/nodejs/ssrf-url-validation.md)
|
||||
- [java:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/java/ssrf-url-validation.md)
|
||||
- [php:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/php/ssrf-url-validation.md)
|
||||
- [python:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/python/ssrf-url-validation.md)
|
||||
- [ruby:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/ruby/ssrf-url-validation.md)
|
||||
- [csharp:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/csharp/ssrf-url-validation.md)
|
||||
- [go:ssrf-url-validation](/Users/x/websafe/05-defense/secure-code/go/ssrf-url-validation.md)
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
title: "Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2026-01-27T19:18:25Z"
|
||||
updated_date: "2026-02-10T01:28:46.973023Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-59471"
|
||||
- "GHSA-9g9p-9gw9-jx7f"
|
||||
affected_versions:
|
||||
- "introduced=10.0.0, fixed<15.5.10"
|
||||
- "introduced=15.6.0-canary.0, fixed<16.1.5"
|
||||
fixed_versions:
|
||||
- "15.5.10"
|
||||
- "16.1.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f"
|
||||
---
|
||||
|
||||
# Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-59471`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
|
||||
- 影响版本: `introduced=10.0.0, fixed<15.5.10, introduced=15.6.0-canary.0, fixed<16.1.5`
|
||||
- 修复版本: `15.5.10, 16.1.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-59471
|
||||
- https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
|
||||
- https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
|
||||
- https://github.com/vercel/next.js
|
||||
- https://github.com/vercel/next.js/releases/tag/v15.5.10
|
||||
- https://github.com/vercel/next.js/releases/tag/v16.1.5
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
title: "Next.js has Unbounded Memory Consumption via PPR Resume Endpoint "
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2026-01-28T15:20:55Z"
|
||||
updated_date: "2026-02-06T13:13:43.709252Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "CVE-2025-59472"
|
||||
- "GHSA-5f7q-jpqc-wp7h"
|
||||
affected_versions:
|
||||
- "introduced=15.0.0-canary.0, fixed<15.6.0-canary.61"
|
||||
- "introduced=16.0.0-beta.0, fixed<16.1.5"
|
||||
fixed_versions:
|
||||
- "15.6.0-canary.61"
|
||||
- "16.1.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"
|
||||
---
|
||||
|
||||
# Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--CVE-2025-59472`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
|
||||
- 影响版本: `introduced=15.0.0-canary.0, fixed<15.6.0-canary.61, introduced=16.0.0-beta.0, fixed<16.1.5`
|
||||
- 修复版本: `15.6.0-canary.61, 16.1.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-59472
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
title: "Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-12-12T17:21:57Z"
|
||||
updated_date: "2026-02-04T02:46:38.768104Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "GHSA-5j59-xgg2-r9c4"
|
||||
affected_versions:
|
||||
- "introduced=13.3.1-canary.0, fixed<14.2.35"
|
||||
- "introduced=15.0.6, fixed<15.0.7"
|
||||
- "introduced=15.1.10, fixed<15.1.11"
|
||||
- "introduced=15.2.7, fixed<15.2.8"
|
||||
- "introduced=15.3.7, fixed<15.3.8"
|
||||
- "introduced=15.4.9, fixed<15.4.10"
|
||||
- "introduced=15.5.8, fixed<15.5.9"
|
||||
- "introduced=15.6.0-canary.59, fixed<15.6.0-canary.60"
|
||||
- "introduced=16.0.9, fixed<16.0.10"
|
||||
- "introduced=16.1.0-canary.17, fixed<16.1.0-canary.19"
|
||||
fixed_versions:
|
||||
- "14.2.35"
|
||||
- "15.0.7"
|
||||
- "15.1.11"
|
||||
- "15.2.8"
|
||||
- "15.3.8"
|
||||
- "15.4.10"
|
||||
- "15.5.9"
|
||||
- "15.6.0-canary.60"
|
||||
- "16.0.10"
|
||||
- "16.1.0-canary.19"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4"
|
||||
---
|
||||
|
||||
# Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--GHSA-5j59-xgg2-r9c4`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
|
||||
- 影响版本: `introduced=13.3.1-canary.0, fixed<14.2.35, introduced=15.0.6, fixed<15.0.7, introduced=15.1.10, fixed<15.1.11, introduced=15.2.7, fixed<15.2.8, introduced=15.3.7, fixed<15.3.8, introduced=15.4.9, fixed<15.4.10, introduced=15.5.8, fixed<15.5.9, introduced=15.6.0-canary.59, fixed<15.6.0-canary.60, introduced=16.0.9, fixed<16.0.10, introduced=16.1.0-canary.17, fixed<16.1.0-canary.19`
|
||||
- 修复版本: `14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-67779
|
||||
- https://github.com/vercel/next.js
|
||||
- https://nextjs.org/blog/security-update-2025-12-11
|
||||
- https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
|
||||
- https://www.cve.org/CVERecord?id=CVE-2025-55184
|
||||
- https://www.facebook.com/security/advisories/cve-2025-67779
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
@@ -0,0 +1,104 @@
|
||||
---
|
||||
title: "Next.js is vulnerable to RCE in React flight protocol"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-12-03T19:07:11Z"
|
||||
updated_date: "2026-02-04T03:45:15.823345Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "GHSA-9qr9-h5gf-34mp"
|
||||
affected_versions:
|
||||
- "introduced=14.3.0-canary.77, fixed<15.0.5"
|
||||
- "introduced=15.1.0-canary.0, fixed<15.1.9"
|
||||
- "introduced=15.2.0-canary.0, fixed<15.2.6"
|
||||
- "introduced=15.3.0-canary.0, fixed<15.3.6"
|
||||
- "introduced=15.4.0-canary.0, fixed<15.4.8"
|
||||
- "introduced=15.5.0-canary.0, fixed<15.5.7"
|
||||
- "introduced=16.0.0-canary.0, fixed<16.0.7"
|
||||
fixed_versions:
|
||||
- "15.0.5"
|
||||
- "15.1.9"
|
||||
- "15.2.6"
|
||||
- "15.3.6"
|
||||
- "15.4.8"
|
||||
- "15.5.7"
|
||||
- "16.0.7"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
primary_source: "https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r"
|
||||
---
|
||||
|
||||
# Next.js is vulnerable to RCE in React flight protocol
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--GHSA-9qr9-h5gf-34mp`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
|
||||
- 影响版本: `introduced=14.3.0-canary.77, fixed<15.0.5, introduced=15.1.0-canary.0, fixed<15.1.9, introduced=15.2.0-canary.0, fixed<15.2.6, introduced=15.3.0-canary.0, fixed<15.3.6, introduced=15.4.0-canary.0, fixed<15.4.8, introduced=15.5.0-canary.0, fixed<15.5.7, introduced=16.0.0-canary.0, fixed<16.0.7`
|
||||
- 修复版本: `15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
|
||||
- https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
|
||||
- https://github.com/vercel/next.js
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
@@ -0,0 +1,117 @@
|
||||
---
|
||||
title: "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2026-01-28T15:38:01Z"
|
||||
updated_date: "2026-02-13T00:43:52.836085Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "GHSA-h25m-26qc-wcjf"
|
||||
affected_versions:
|
||||
- "introduced=13.0.0, fixed<15.0.8"
|
||||
- "introduced=15.1.1-canary.0, fixed<15.1.12"
|
||||
- "introduced=15.2.0-canary.0, fixed<15.2.9"
|
||||
- "introduced=15.3.0-canary.0, fixed<15.3.9"
|
||||
- "introduced=15.4.0-canary.0, fixed<15.4.11"
|
||||
- "introduced=15.5.1-canary.0, fixed<15.5.10"
|
||||
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.61"
|
||||
- "introduced=16.0.0-beta.0, fixed<16.0.11"
|
||||
- "introduced=16.1.0-canary.0, fixed<16.1.5"
|
||||
fixed_versions:
|
||||
- "15.0.8"
|
||||
- "15.1.12"
|
||||
- "15.2.9"
|
||||
- "15.3.9"
|
||||
- "15.4.11"
|
||||
- "15.5.10"
|
||||
- "15.6.0-canary.61"
|
||||
- "16.0.11"
|
||||
- "16.1.5"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
- "deserialization-safety"
|
||||
primary_source: "https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg"
|
||||
---
|
||||
|
||||
# Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--GHSA-h25m-26qc-wcjf`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
|
||||
- 影响版本: `introduced=13.0.0, fixed<15.0.8, introduced=15.1.1-canary.0, fixed<15.1.12, introduced=15.2.0-canary.0, fixed<15.2.9, introduced=15.3.0-canary.0, fixed<15.3.9, introduced=15.4.0-canary.0, fixed<15.4.11, introduced=15.5.1-canary.0, fixed<15.5.10, introduced=15.6.0-canary.0, fixed<15.6.0-canary.61, introduced=16.0.0-beta.0, fixed<16.0.11, introduced=16.1.0-canary.0, fixed<16.1.5`
|
||||
- 修复版本: `15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2026-23864
|
||||
- https://github.com/vercel/next.js
|
||||
- https://vercel.com/changelog/summary-of-cve-2026-23864
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
- [javascript-typescript:deserialization-safety](/Users/x/websafe/05-defense/secure-code/javascript-typescript/deserialization-safety.md)
|
||||
- [nodejs:deserialization-safety](/Users/x/websafe/05-defense/secure-code/nodejs/deserialization-safety.md)
|
||||
- [java:deserialization-safety](/Users/x/websafe/05-defense/secure-code/java/deserialization-safety.md)
|
||||
- [php:deserialization-safety](/Users/x/websafe/05-defense/secure-code/php/deserialization-safety.md)
|
||||
- [python:deserialization-safety](/Users/x/websafe/05-defense/secure-code/python/deserialization-safety.md)
|
||||
- [ruby:deserialization-safety](/Users/x/websafe/05-defense/secure-code/ruby/deserialization-safety.md)
|
||||
- [csharp:deserialization-safety](/Users/x/websafe/05-defense/secure-code/csharp/deserialization-safety.md)
|
||||
- [go:deserialization-safety](/Users/x/websafe/05-defense/secure-code/go/deserialization-safety.md)
|
||||
@@ -0,0 +1,109 @@
|
||||
---
|
||||
title: "Next Vulnerable to Denial of Service with Server Components"
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-12-11T22:49:27Z"
|
||||
updated_date: "2026-02-04T03:55:54.855562Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "GHSA-mwv6-3258-q52c"
|
||||
affected_versions:
|
||||
- "introduced=13.3.0, fixed<14.2.34"
|
||||
- "introduced=15.0.0-canary.0, fixed<15.0.6"
|
||||
- "introduced=15.1.1-canary.0, fixed<15.1.10"
|
||||
- "introduced=15.2.0-canary.0, fixed<15.2.7"
|
||||
- "introduced=15.3.0-canary.0, fixed<15.3.7"
|
||||
- "introduced=15.4.0-canary.0, fixed<15.4.9"
|
||||
- "introduced=15.5.1-canary.0, fixed<15.5.8"
|
||||
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.59"
|
||||
- "introduced=16.0.0-beta.0, fixed<16.0.9"
|
||||
- "introduced=16.1.0-canary.0, fixed<16.1.0-canary.17"
|
||||
fixed_versions:
|
||||
- "14.2.34"
|
||||
- "15.0.6"
|
||||
- "15.1.10"
|
||||
- "15.2.7"
|
||||
- "15.3.7"
|
||||
- "15.4.9"
|
||||
- "15.5.8"
|
||||
- "15.6.0-canary.59"
|
||||
- "16.0.9"
|
||||
- "16.1.0-canary.17"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c"
|
||||
---
|
||||
|
||||
# Next Vulnerable to Denial of Service with Server Components
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--GHSA-mwv6-3258-q52c`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
|
||||
- 影响版本: `introduced=13.3.0, fixed<14.2.34, introduced=15.0.0-canary.0, fixed<15.0.6, introduced=15.1.1-canary.0, fixed<15.1.10, introduced=15.2.0-canary.0, fixed<15.2.7, introduced=15.3.0-canary.0, fixed<15.3.7, introduced=15.4.0-canary.0, fixed<15.4.9, introduced=15.5.1-canary.0, fixed<15.5.8, introduced=15.6.0-canary.0, fixed<15.6.0-canary.59, introduced=16.0.0-beta.0, fixed<16.0.9, introduced=16.1.0-canary.0, fixed<16.1.0-canary.17`
|
||||
- 修复版本: `14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://github.com/vercel/next.js
|
||||
- https://nextjs.org/blog/security-update-2025-12-11
|
||||
- https://www.cve.org/CVERecord?id=CVE-2025-55184
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
@@ -0,0 +1,107 @@
|
||||
---
|
||||
title: "Next Server Actions Source Code Exposure "
|
||||
system_id: "nextjs"
|
||||
category: "frameworks"
|
||||
advisory_mode: "core"
|
||||
published_date: "2025-12-11T22:49:56Z"
|
||||
updated_date: "2026-02-04T02:51:40.627151Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
allow_public_validation: "yes, with ownership or explicit authorization"
|
||||
authorization_prerequisite: "asset ownership proof or explicit written authorization"
|
||||
minimal_validation: "read-only probe, controlled payload, reversible test"
|
||||
aliases:
|
||||
- "GHSA-w37m-7fhw-fmv9"
|
||||
affected_versions:
|
||||
- "introduced=15.0.0-canary.0, fixed<15.0.6"
|
||||
- "introduced=15.1.1-canary.0, fixed<15.1.10"
|
||||
- "introduced=15.2.0-canary.0, fixed<15.2.7"
|
||||
- "introduced=15.3.0-canary.0, fixed<15.3.7"
|
||||
- "introduced=15.4.0-canary.0, fixed<15.4.9"
|
||||
- "introduced=15.5.1-canary.0, fixed<15.5.8"
|
||||
- "introduced=15.6.0-canary.0, fixed<15.6.0-canary.59"
|
||||
- "introduced=16.0.0-beta.0, fixed<16.0.9"
|
||||
- "introduced=16.1.0-canary.0, fixed<16.1.0-canary.17"
|
||||
fixed_versions:
|
||||
- "15.0.6"
|
||||
- "15.1.10"
|
||||
- "15.2.7"
|
||||
- "15.3.7"
|
||||
- "15.4.9"
|
||||
- "15.5.8"
|
||||
- "15.6.0-canary.59"
|
||||
- "16.0.9"
|
||||
- "16.1.0-canary.17"
|
||||
secure_code_topics:
|
||||
- "authz-server-side-recheck"
|
||||
- "proxy-trust-boundary"
|
||||
- "token-cookie-storage"
|
||||
- "dependency-upgrade-policy"
|
||||
primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9"
|
||||
---
|
||||
|
||||
# Next Server Actions Source Code Exposure
|
||||
|
||||
## 事件层
|
||||
|
||||
- Canonical ID: `nextjs--GHSA-w37m-7fhw-fmv9`
|
||||
- 系统: `nextjs`
|
||||
- 严重度: `low`
|
||||
- 来源置信度: `official`
|
||||
- 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
|
||||
- 影响版本: `introduced=15.0.0-canary.0, fixed<15.0.6, introduced=15.1.1-canary.0, fixed<15.1.10, introduced=15.2.0-canary.0, fixed<15.2.7, introduced=15.3.0-canary.0, fixed<15.3.7, introduced=15.4.0-canary.0, fixed<15.4.9, introduced=15.5.1-canary.0, fixed<15.5.8, introduced=15.6.0-canary.0, fixed<15.6.0-canary.59, introduced=16.0.0-beta.0, fixed<16.0.9, introduced=16.1.0-canary.0, fixed<16.1.0-canary.17`
|
||||
- 修复版本: `15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17`
|
||||
|
||||
## 其他来源
|
||||
|
||||
- https://github.com/vercel/next.js
|
||||
- https://nextjs.org/blog/security-update-2025-12-11
|
||||
- https://www.cve.org/CVERecord?id=CVE-2025-55183
|
||||
|
||||
## 实验层
|
||||
|
||||
- 仅用于自有资产、测试环境或已明确授权目标。
|
||||
- 允许公网可达目标，但必须满足资产归属或明确授权前提。
|
||||
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
|
||||
- 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。
|
||||
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
|
||||
|
||||
## 修复示例
|
||||
|
||||
- [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md)
|
||||
- [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md)
|
||||
- [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md)
|
||||
- [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md)
|
||||
- [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md)
|
||||
- [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md)
|
||||
- [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md)
|
||||
- [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md)
|
||||
- [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md)
|
||||
- [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md)
|
||||
- [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md)
|
||||
- [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md)
|
||||
- [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md)
|
||||
- [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md)
|
||||
- [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md)
|
||||
- [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md)
|
||||
- [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md)
|
||||
- [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md)
|
||||
- [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md)
|
||||
- [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md)
|
||||
- [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md)
|
||||
- [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md)
|
||||
- [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md)
|
||||
- [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)
|
||||
- [javascript-typescript:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/javascript-typescript/dependency-upgrade-policy.md)
|
||||
- [nodejs:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/nodejs/dependency-upgrade-policy.md)
|
||||
- [java:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/java/dependency-upgrade-policy.md)
|
||||
- [php:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/php/dependency-upgrade-policy.md)
|
||||
- [python:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/python/dependency-upgrade-policy.md)
|
||||
- [ruby:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/ruby/dependency-upgrade-policy.md)
|
||||
- [csharp:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/csharp/dependency-upgrade-policy.md)
|
||||
- [go:dependency-upgrade-policy](/Users/x/websafe/05-defense/secure-code/go/dependency-upgrade-policy.md)
|
||||
在新工单中引用
屏蔽一个用户