{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d28ce2bd-68f5-5209-b1a1-f9aa82ef4318", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@12.3.7-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/next@12.3.7-tuxcare.12", "version": "12.3.7-tuxcare.12", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@12.3.7", "type": "library", "version": "12.3.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:56eb4dcf-8f38-546c-8fce-693ffdc08726", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is NOT affected by CVE-2017-16877 (directory traversal under /_next and /static). The vulnerability pattern is not present because an upstream Next.js fix (commit 8ca32f15f771 by Jiachi Liu, 2022-01-19) was already included in the upstream release before TuxCare's maintenance began. The fix implements path traversal protection via the isServeableUrl() method, which val...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:743079a2-602c-55a0-8a48-714273d7d18e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Target version 12.3.7 is not affected by CVE-2018-18282. The vulnerability affected only Next.js versions 7.0.0 and 7.0.1 (a narrow regression quickly fixed in 7.0.2). The target version is ~5 major versions newer and uses React's auto-escaping for all error page content rendering, which prevents XSS. The vulnerable pattern no longer exists in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:550cb9da-7c0c-5455-a7fc-1fb05b25b6c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:0202468e-1241-58dc-a5bc-7c62a3ae6909", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2020-15242 affects Next.js 9.5.0-9.5.3 due to automatic URL decoding in path-match that could lead to encoding edge-cases and security bypasses. The vulnerability was fixed in v9.5.4 (commit c351f6154bc, Oct 2020) by removing automatic decoding. Target version 12.3.7-tuxcare.13 (released Mar 2025) includes this upstream fix - the vulnerable code pattern (decode: decodeParam option and decod...", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:a0336f00-8acd-5872-9ddc-764d5aee35ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2020-5284 directory traversal vulnerability is NOT present in Next.js 12.3.7-tuxcare.13. The upstream fix (commit 1d6ffc39f7b) was already included in version 12.3.7 before TuxCare maintenance began. The target contains the complete security defense: isServeableUrl() method validates all static file requests by decoding URLs, resolving paths, checking for null bytes, validating directory bo...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:5eea3841-e0d5-5e3a-906a-a05b4de7bc36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2021-37699 (open redirect via repeated slashes) is not present in Next.js 12.3.7-tuxcare.13. The vulnerability was fixed in the upstream Next.js release (commit 4ab41efdbfd by JJ Kasper) before TuxCare onboarded this version. The target contains the complete defense: detection of URLs with repeated slashes or backslashes via regex pattern /(\\\\|\\/\\/)/, normalization using normalizeRepeatedSl...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:4e562247-192a-57ce-a342-d224aacfb377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:3eec245d-148a-5070-bc81-d6ab1d8188ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:c0eda63f-4fbf-53d7-ab2d-44dfd0c26200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2022-21721 affects Next.js versions >= 12.0.0 with i18n enabled, causing a DoS via infinite request processing loop when accessing locale-prefixed internal paths (e.g., /en/_next/static/...). The vulnerability was fixed in Next.js 12.0.9 via commit 69524c290d8 (Jan 2022). The target version 12.3.7-tuxcare.13 is based on upstream Next.js 12.3.7 (released well after 12.0.9), which already con...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:995f3663-6fd5-538f-aa60-cff280b030b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 The target Next.js 12.3.7-tuxcare.13 contains the vulnerable cache control pattern (max-age=${isDev ? 0 : maxAge}) but is protected in the default configuration by the dangerouslyAllowSVG=false check at lines 710-718 of image-optimizer.ts. This runtime defense blocks SVG requests before they can be cached, preventing the CVE-2022-23646 attack vector. The defense was added by upstream (commit 8a...", "justification": "protected_at_runtime" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:4bda78c5-d648-5471-b481-88d31934d65b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2022-36046 affected Next.js v12.2.3 specifically, where accessing undefined URLPattern in packages/next/server.js caused unhandled promise rejections that crashed Node.js v15+ processes with strict unhandledRejection handling. The vulnerability was fixed in upstream Next.js v12.2.4 (commit de41597bc83 by JJ Kasper) by adding a conditional check before accessing URLPattern. The target versio...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:623e58ac-565d-5dc2-b42e-1ffb45b66358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46298 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:f1bc75d5-4dbc-5c3f-a4a0-53ee0f9d3e02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:ab8a071f-7615-5ff0-b84e-05a9f1016c18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:b1bfc4ba-934d-520d-8e9a-80e0578594bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:5775eb39-6ace-541c-ab41-ac22fa31b3e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:246f417f-7cb7-5b49-8b2f-4db03230379b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:df1eaa89-69be-5519-8477-8619d68ac5d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:5fad446f-c44b-5ce7-946f-1bf66a73e079", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 does not support Server Actions, which were introduced in Next.js 13.4 (May 2023). CVE-2024-56332 explicitly states it \"affects only Next.js deployments using Server Actions.\" The vulnerable server-side reply parsing code (`react-server-dom-*-server.*.js` files containing `decodeReply` function) does not exist in this version. The attack vector (Server Action requests with incomp...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:6ea00410-6ceb-5772-b6f8-2a17c0d31dbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:a9b5e71e-015a-5272-964e-01bc37322c41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-30218 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is not affected by CVE-2025-30218. This vulnerability concerns the exposure of the internal `x-middleware-set-cookie` header in HTTP responses. Version 12.3.7 uses a different cookie handling architecture that directly manipulates the `set-cookie` header without the intermediate `x-middleware-set-cookie` mechanism that is vulnerable in newer versions (14.x, 15.x, 16.x)...", "justification": "code_not_present" } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:10a2aace-600d-5fa4-8806-253bd4b099de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:11364deb-92e3-5f95-880e-a1ec93f40d05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:90e4857c-4d0e-50fc-a21a-b1e98cc7442a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is NOT AFFECTED by CVE-2025-49005. The CVE affects versions >=15.3.0 and <15.3.3. In 12.3.7, RSC/Flight requests explicitly bypass the cache (ssgCacheKey=null when isFlightRequest=true, base-server.ts:1252-1259), preventing RSC payloads from being cached and served in place of HTML. The vulnerability chain is broken because RSC responses cannot enter the cache in this version. Th...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:32dcd2fa-de8f-5a95-af4b-520a6baa7ca9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:3925f27a-e53b-593b-92eb-0f0ee3bfe240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:f4046763-ac74-537b-b448-b5a591ee2e42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:e27c06ab-b07f-55d8-95f9-ab6b2bd29297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:bbf26f24-8053-5085-84b7-7a0b09b65b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:a2bfcc72-9518-5ca2-8b9f-37b60be8c408", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.7 is not affected by CVE-2025-59472. The vulnerability requires Partial Prerendering (PPR) functionality, which was introduced in Next.js 14 and does not exist in version 12.3.7. The vulnerable code path\u2014specifically the PPR resume endpoint that accepts POST requests with the Next-Resume header and processes postponed state data\u2014is entirely absent from this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:bb9c7cc3-d363-5544-8e78-756242e66514", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js version 12.3.7-tuxcare.13 is not affected by CVE-2026-103004 because the 'use cache' feature, which is the subject of this vulnerability, does not exist in this version. The 'use cache' feature was introduced in Next.js v15.0.0, while the target is version 12.3.7. The vulnerability concerns improper metadata propagation in nested 'use cache' function calls leading to cache poisoning acr...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:226f95df-14f3-59ef-876d-fa8b06ccc321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:02221a0d-a4c8-5b86-877c-495027e1b375", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by CVE-2026-27978 because Server Actions do not exist as a feature in this version. Server Actions were introduced in Next.js 13.4 (May 2023), while version 12.3.7 was released in October 2022. The vulnerable code path (Server Action CSRF validation in action-handler.ts) is completely absent from this version. The vulnerability requires the presence of Server Acti...", "justification": "code_not_present" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:1c6ef846-1007-548f-b301-48dcca9999a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27979 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by CVE-2026-27979. The vulnerability requires the Partial Prerendering (PPR) feature with App Router, which was introduced in Next.js 15/16. Version 12.3.7 predates PPR by several years and does not contain any of the vulnerable code paths: no `next-resume` header handling, no `maxPostponedStateSize` configuration, no postponed state buffering functionality, and n...", "justification": "code_not_present" } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:53291aba-6ecd-5742-aebc-6f1d2c389d62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:04508719-274a-595f-9bed-bb95af23b682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:b9091637-486f-5934-ab7d-9d6e9c628232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:baf94103-97a1-5223-a435-329c942856be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:6bc74855-b67d-55a2-b502-611be821eeb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:09468542-4b4f-55a1-976d-1d56b24b6cf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:47a64b62-afb6-53e7-adc5-196edcbdfd2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44576 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by CVE-2026-44576. This CVE targets the newer header-based RSC mechanism (v13+) where the `rsc` header indicates RSC requests without changing the URL, enabling cache poisoning attacks. Version 12.3.7 uses the older query-parameter-based architecture (`__flight__` parameter) which naturally partitions cache by URL, preventing the attack vector described in the CVE.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:d602b5ec-e922-5570-9738-847d1a4d7447", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:bf4023fe-750b-5964-96eb-911313ea2045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:48799d3c-c030-5e42-bbb9-61ec4629a950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:04b42ed9-91ce-5405-b153-ce065c0302ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44580 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js v12.3.7-tuxcare.13 is NOT affected by CVE-2026-44580. The vulnerability requires a specific code architecture where beforeInteractive script properties are JSON-serialized and embedded into inline script innerHTML (the `__next_s` pattern). This architecture does not exist in v12.3.7. Instead, v12.3.7 spreads script properties as HTML attributes, which React's JSX rendering safely HTML-e...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:76e6cf32-431f-5046-ace5-eeb142a92c5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44581 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:b89cc13b-aa36-57a9-922d-15ce2e7f252e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44582 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is NOT affected by CVE-2026-44582. This version predates the modern App Router (Next.js 13+) and uses an entirely different RSC implementation with __flight__ query parameters instead of the _rsc cache-busting mechanism. The vulnerable code pattern (weak hexHash-based _rsc parameter allowing cache collisions) does not exist in this version. Exhaustive search confirms: ...", "justification": "code_not_present" } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:d35da825-9331-5448-a4c7-dcdaabdc0ea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:ca27da39-397e-57cc-86f8-22c4fa0fbd23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:83d626d3-d121-5c0c-9e0e-d997bac3775a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:cce21540-3945-5c89-964d-667433faa35f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64643 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js v12.3.7 is not affected by CVE-2026-64643. The vulnerability concerns Server Action ID disclosure in Next.js applications using App Router and Server Actions. Server Actions were introduced in Next.js v13.4.0 (May 2023), while the target version 12.3.7 was released in 2022, predating this feature by several major versions. The target codebase contains no Server Actions infrastructure: n...", "justification": "code_not_present" } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:7496a5c3-4c38-5942-bbb3-e45bdb22b07b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64644 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 CVE-2026-64644 does not affect Next.js version 12.3.7-tuxcare.13. The vulnerable code pattern (expensive sharp().metadata() fallback during image type detection) does not exist in this version. The vulnerability was introduced in later Next.js versions (13.x+) when the detector() function and metadata fallback were added to detectContentType(). The target uses a simple, synchronous magic-number...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:80b930e5-256f-575f-b402-8cbcdf055878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:244efbe7-a743-58b8-a87d-1d75b824c638", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64646 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js version 12.3.7 is not affected by CVE-2026-64646. The vulnerability requires Server Actions with Edge runtime, a feature introduced in Next.js 13.4.0 (May 2023). Version 12.3.7, released in August 2022, predates Server Actions entirely. The vulnerable code path (packages/next/src/server/app-render/action-handler.ts) does not exist in this version. While 12.3.7 has experimental React Ser...", "justification": "code_not_present" } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:62e6cb47-2a85-5763-b9e7-32d710f56ccb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64647 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by CVE-2026-64647. The vulnerability requires the App Router's fetch caching mechanism with generateCacheKey() that uses lossy UTF-8 decoding on request bodies. This feature was introduced in Next.js 13+. Version 12.3.7 only has Pages Router with basic ISR (page-level caching), not fetch-level response caching based on request body content. The attack chain (reque...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:c56e0733-1ebe-5ad5-ad4b-7d0c7ce84401", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64648 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is NOT AFFECTED by CVE-2026-64648. The vulnerability requires server-side fetch response caching with cache key calculation (provided by patch-fetch.ts), which was introduced in Next.js 13.1.7-canary.23 (Feb 2023), over 1,700 commits after version 12.3.7. While version 12.3.7 CAN execute server-side fetch calls with Request and init parameters (the vulnerability's INPU...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:aa5a7f0d-3be3-55d9-850b-7ebd680f213d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:0f1862d5-7a45-5046-99bc-105001e43090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75604 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:7957d0a1-bca3-54d1-947e-3a5328dc4ca1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:71de7528-16ed-5420-b7c8-97981e02c445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:40e452aa-326a-55ef-95e2-7ca36bb39462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94484 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:eee82a16-d3a2-5c50-8bc8-39bc75e64310", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94485 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is not affected by CVE-2026-94485. The vulnerability concerns metadata image routes (opengraph-image, twitter-image) in the App Router ignoring the dynamicParams configuration. This feature was introduced in Next.js 13.2.x (commit 36ca1598d5d), and version 12.3.7 predates it entirely. The vulnerable file next-metadata-route-loader.ts does not exist, and the App Router ...", "justification": "code_not_present" } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:21da3fa3-9b64-567b-8037-3663f099a1fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by CVE-2026-94486. The vulnerability concerns the Model Context Protocol (MCP) endpoint (/_next/mcp) exposed by the Next.js development server, which allows DNS rebinding attacks to bypass origin verification and access sensitive development data. This MCP feature does not exist in Next.js 12.3.7. The MCP functionality was introduced in Next.js 15+ (circa 2026), w...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:63f401c0-d0f1-5e91-9d76-b1a5a6809f86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94543 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:a44756b2-c0b3-5360-aa41-8294dff03167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js v12.3.7 is not affected by CVE-2026-94544 because the vulnerable feature does not exist in this version. The CVE affects the 'use cache' directive (Cache Components feature), which was introduced in Next.js 15.0.0-canary. Version 12.3.7 predates this feature by three major versions. The target has no code that processes use cache directives, no cache deduplication infrastructure for cac...", "justification": "code_not_present" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:62d64dae-2e7b-5b65-b83e-a7a8946e6aed", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.12 is not affected by GHSA-2464-fhr4-w9xw. The vulnerability exists in the sharp library (< 0.35.5), which is an optional external dependency that is NOT declared, shipped, or required by this Next.js version. The target uses Squoosh for image optimization by default and only attempts to load sharp if manually installed by the user. Without sharp installed, the attack cha...", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:0abd9d92-7060-5c3a-b977-6be07aa0907b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:8f6b17be-3529-5f06-ad0d-6d330e1266cd", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:5f30bea4-ec1d-57c3-b047-52f1e09c6a7f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 The target repository (Next.js 12.3.7-tuxcare.13) is not affected by GHSA-5vj8-3v2h-h38v (Remote Code Execution via path traversal in page loading). The vulnerability allowed attackers to pass unsanitized paths with traversal sequences (../) to require() calls, enabling arbitrary JavaScript execution. The upstream vendor (Vercel/Next.js) fixed this in version 5.1.0 by adding path normalization ...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:0e6ceae8-4381-50ed-8f5d-97f5bdebe3b9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-673q-mjm6-r5xr does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7-tuxcare.13 is not affected by GHSA-673q-mjm6-r5xr. The target uses an early version of React Server Components that predates Server Actions entirely. The vulnerable code pattern (loadServerReference function handling bound server action metadata with TypedArray values) does not exist in this version. The target's react-server-dom-webpack implementation (885 lines) is significantl...", "justification": "code_not_present" } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:dec4714a-d622-597d-bba8-303cd4a23891", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:4dbf41b3-1118-5c50-bd9d-3019700fa825", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:6c94543e-2d9d-5ab2-9071-18771e4034d4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:e9f2136b-2739-5a79-b676-d70571ceebef", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:47fde8e0-7f15-5c43-b77e-f5a5c36accee", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 12.3.7-tuxcare.12 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:5ff702db-f355-5481-a430-42b1425ba891", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js v12.3.7 is not affected by GHSA-vcvr-r3jv-pc5j. The vulnerability affects the Node.js ImageResponse implementation from the next/og package, which was introduced in Next.js v13.5.6+ (October 2023). Version 12.3.7 predates this feature entirely and does not contain the vulnerable code. The next/og package, ImageResponse API, and @vercel/og dependency are completely absent from this version.", "justification": "code_not_present" } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ], "bom-ref": "urn:uuid:405df9f0-2c67-5531-9a2e-ac77cf78f3ad", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 does not affect version 12.3.7-tuxcare.12 of next. not_affected \u2014 Next.js 12.3.7 is not affected by GHSA-w37m-7fhw-fmv9 (CVE-2025-55183). This version predates the introduction of Server Actions (added in Next.js 13.4.0, May 2023) and does not contain the vulnerable code path. The vulnerability requires the action decoding pipeline (decodeAction/decodeReply functions) to process HTTP requests with Next-Action headers, which is entirely absent in version 12.3....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/next@12.3.7-tuxcare.12" } ] }