{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0d1bf91c-5313-57f9-af7d-85e46aa4be93", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@13.5.11-tuxcare.19", "type": "library", "bom-ref": "pkg:npm/next@13.5.11-tuxcare.19", "version": "13.5.11-tuxcare.19", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@13.5.11", "type": "library", "version": "13.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2024-10173", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:5ce49fa6-9e7f-5910-a929-2478cb8f40dc", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2024-10173 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "AIKIDO-2025-10936", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:82a863fa-3c35-5c11-8350-d33478d9f31c", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10936 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9991302f-63f0-54e8-804f-b96c4aa32895", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2017-16877 describes a directory traversal vulnerability in Next.js before version 2.4.1 under the /_next and /static request namespaces. The target repository is Next.js version 13.5.11-tuxcare.20, which is many major versions newer than the affected range. The vulnerability was fixed in upstream version 2.4.1 (released in 2017), and that fix was already present in the upstream release 13....", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:552ca194-c72c-5b04-bbd0-5690e8378e36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2018-18282 affects Next.js 7.0.0 and 7.0.1 with XSS via error pages. The vulnerability was fixed in upstream Next.js v7.0.2 (December 2018) by commit 4426fdb98e3, which stopped passing user-controlled pathname to error rendering. Target version 13.5.11 (released 2023) is 6+ major versions newer and includes this upstream fix. The error page now only renders static status codes and predefine...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:575c9df2-75ff-5e89-a384-d5b32174160f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0fa239d7-e95f-5575-9b5f-026258e7bd2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2020-15242 is a directory traversal vulnerability affecting Next.js versions 9.5.0-9.5.3, fixed in v9.5.4 (released in 2020). The target version 13.5.11-tuxcare.20 is based on upstream Next.js 13.5.11 (released October 2023), which inherits the fix from v9.5.4. The vulnerable code pattern is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1039fed6-24c1-5384-b3fc-a0a4f1eb7631", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2020-5284 affects Next.js versions below 9.3.2 due to a directory traversal vulnerability in static file serving. The target version 13.5.11-tuxcare.20 is not affected because the fix was already present in the upstream v13.5.11 release that TuxCare onboarded. The vulnerable code pattern (direct path joining without validation or root option) has been replaced with a whitelist-based validat...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:7c999810-a86d-5d66-aad0-cc8ac2bc649f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2021-37699 affects Next.js 10.0.5-10.2.0 and 11.0.0-11.0.1 via repeated slashes (e.g., //google.com) causing open redirects through protocol-relative URL interpretation. The fix was released in v11.1.0 (August 2021). The target version 13.5.11-tuxcare.20 already contains the upstream fix: normalizeRepeatedSlashes() function detects and redirects repeated slashes/backslashes at request entry...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f8963b0c-d1a4-5558-8359-626a86d83a7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0832071e-f43a-58ae-9bc5-dbbd495733f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:40ff05cf-fa98-52c5-96b7-4803a8659398", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2022-21721 affects Next.js 12.0.0-12.0.8 when using i18n functionality. The vulnerability causes a DoS when requests are made to paths matching `/${locale}/_next/`. The fix was implemented in upstream Next.js v12.0.9 (commit 69524c290d8 by jj@jjsweb.site) by adding an `internalRender` guard to prevent infinite loops when processing internal `_next` paths after locale normalization. Target v...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:d0100716-c5ae-52c3-85b1-bbca8ab0f744", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23646 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:5bccd584-ae41-51c7-aa54-a24c88cc451a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 CVE-2022-36046 affects Next.js v12.2.3, causing unhandled promise rejections that can crash the Node.js process when specific requests are made to the server. The vulnerability was in packages/next/server/body-streams.ts where error events on readable streams were not properly handled. The target repository (Next.js v13.5.11-tuxcare.20) is NOT AFFECTED because the fix was already present in the...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a93fdac1-51d2-5eac-acf2-2ad179056686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e2715fb8-da06-54dd-885a-ba6187691e15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6440a148-6520-5da1-a52b-93aa20d11cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34351 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:79c97555-8d1d-5cd4-b4f4-5ea9b70cf3c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:376338e3-08f6-56b3-bb49-80b82f56b7ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:2b8e23f1-7605-512a-942c-c172c0de7afb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47831 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:4f14ead4-c1ca-5b29-8e2d-a5c56414c0a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-51479 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:004e3f2b-58fb-5381-a855-ae2df055d542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56332 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6e508b38-ec0e-5da2-81a6-750f469d09c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0ade5a1b-4571-56ff-a2dc-0831d111e2e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:7d2fe50c-0b6b-5665-98fc-aba05981d34b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32421 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ff80a9ba-a647-5013-a131-6edf91f47511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48068 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3ffcdcee-2577-590b-bf54-b0b15ba82c54", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Version 13.5.11-tuxcare.20 is not affected by CVE-2025-49005. The vulnerability was introduced in Next.js 15.3.0 by commit f2cf3dc8e42 (April 4, 2025) which skipped setting the Vary header for basic routes, causing RSC payloads to be incorrectly cached and served as HTML. This problematic commit is not present in version 13.5.11. The target version properly sets the Vary header (res.setHeader('...", "justification": "code_not_present" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:916a79fa-8776-5c05-85e8-a94d785266ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:44b66b6e-d3e7-5926-ae92-707d3ace8b69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55173 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-55183", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:117cd66c-3b60-55bb-8258-ff24bd555fc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55183 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-55184", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:43c62afb-8552-55a2-9abb-0874c75fbf41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55184 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ee3628d3-fab3-562d-8b93-3a52d8437994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57752 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:edc6ab4e-b0dd-52a1-94ef-e4509bb5b098", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57822 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f26a6805-24d3-5f7d-9eb9-6c19c0a58651", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6f5abfe5-8bec-5fc8-b790-161ee564882f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59472 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Version 13.5.11-tuxcare.13 is not affected by CVE-2025-59472. The vulnerable PPR (Partial Prerendering) resume endpoint feature does not exist in this version. The resume endpoint handler that processes `Next-Resume: 1` headers, the postponed-state processing logic, and the resume-data-cache decompression code were all introduced in much later Next.js versions (v16.3.0+). Version 13.5.11 predat...", "justification": "code_not_present" } }, { "id": "CVE-2025-67779", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:0eef8816-dc52-59e4-87e8-30da382ee476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67779 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f223e25b-386f-5cc4-940a-8d0e9abb2360", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Next.js v13.5.11-tuxcare.20 is not affected by CVE-2026-103004. The vulnerable 'use cache' directive and Cache Components feature (cacheComponents: true) were introduced in Next.js v15.0.0-canary.169, which is 2+ major versions after v13.5.11. The target version predates the introduction of the vulnerable feature entirely. The file packages/next/src/server/use-cache/use-cache-wrapper.ts modifie...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c7b99e53-c2db-5be4-b12d-f1a3c371cd11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:2a4f6791-92b0-5537-989c-252c0144ba33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 The target Next.js 13.5.11-tuxcare.20 is NOT vulnerable to CVE-2026-27978. The vulnerable code pattern described in the CVE\u2014where `Origin: null` headers are explicitly filtered out via `&& originHeader !== 'null'` and treated as missing origins, allowing CSRF bypass\u2014is not present in this version. The target's origin validation code at lines 809-812 will instead throw a TypeError when processin...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:71ccb38c-9dd4-5eca-b79f-48d84cf0568b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27979 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Next.js 13.5.11 is not affected by CVE-2026-27979. The vulnerability concerns unbounded buffering of PPR (Partial Prerendering) resume request bodies sent with the `next-resume: 1` header. This PPR resume request handling feature was first introduced in Next.js v16.1.5 (January 2026) and does not exist in version 13.5.11. The target version has no code to process `next-resume` headers, buffer p...", "justification": "code_not_present" } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f0ebec55-3190-53d9-9c00-d4b07ab7750f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3b73d960-f9d3-52da-8ce8-cac41f3b90d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f975d7bb-7f45-5637-bff7-387eef5eddaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3a2ea22c-5a68-53af-a4e4-91fbc0e69041", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:85c663a0-d626-5036-a6c1-736ef7c26cc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e219e940-f56e-5540-af4b-2645a8ffb9f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:706cb87e-73a2-5f13-95f1-f1f519473e10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44576 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3def00a7-ad3e-5ade-9497-e1163c562661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9f610808-0f84-571c-8725-4f7856d3f17c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:4d0dc3aa-c911-51ad-8226-65c44b9eb43f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:cf20f028-8117-5562-afa4-31ce959f7997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:848a37e0-e49d-5e22-a3cd-0017118ef8ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c3434222-4e00-5384-a6cd-3ee2387f4d6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a000aa5b-637a-50ca-b14a-c07e78df88fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ec874c7d-a52e-54eb-9d47-8e049c2dadc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:f2526a89-3ae3-5777-95b9-91d35b392c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:b389a289-68bb-54af-ab75-852ee3fb7b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c936eaa1-aa98-5129-ab9a-ddb9a04a3090", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64644 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Next.js version 13.5.11 is NOT AFFECTED by CVE-2026-64644. The vulnerable code pattern (expensive Sharp metadata extraction fallback in detectContentType) was introduced in later versions (14.x/15.x/16.x) but never existed in version 13.5.11. The target uses a simple, synchronous magic-byte-checking implementation that cannot cause CPU exhaustion.", "justification": "code_not_present" } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:339a016f-801e-5b43-a296-5cd9f2340190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:c4ab4841-5741-562d-ba6d-caf898caf427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:3f6659c1-9843-5429-965a-12ef6c6edf71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a052f4ff-0e2c-5530-8dab-ccdefb43cf83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:5c679519-3929-509c-b31d-e0a0e77928d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e1970693-ecde-5fa3-9ab9-5edb0aaeda7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:32821e5e-99bf-59f2-91eb-8be2a3fd26ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 13.5.11-tuxcare.19 of next, and is fixed in 13.5.11-tuxcare.21." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e1cd0bc7-154a-5407-82bf-2deec1ae68d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:6cb05373-2e8a-5be6-9733-600783868479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94484 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e9352962-c1ac-5cff-9b43-a84f552ecf33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94485 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:9124aa7a-a7c0-53db-b48e-17b01a55a900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 The target Next.js version 13.5.11-tuxcare.20 does not contain the MCP (Model Context Protocol) feature that is vulnerable in CVE-2026-94486. The MCP endpoint (`/_next/mcp`) and associated middleware were introduced in later versions (v16.x+), as confirmed by git history analysis showing the feature introduction commit (58a60479550) is not an ancestor of HEAD. The vulnerable code paths do not e...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:ce4e7be1-0846-5af5-be84-441417485fbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94543 affects version 13.5.11-tuxcare.19 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:187c4baa-3924-536d-aef3-fd777ed8bd55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Next.js version 13.5.11-tuxcare.20 is NOT AFFECTED by CVE-2026-94544. The vulnerability requires the \"use cache\" directive feature with cross-request cache fill deduplication, which was introduced in Next.js 15.x/16.x and does not exist in version 13.5.11. The target lacks: (1) use-cache-wrapper.ts implementation, (2) skipCrossRequestDedupe logic, (3) experimental.useCache configuration support...", "justification": "code_not_present" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:7e8202bb-6b19-5a4d-906f-25f2b7c694ba", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 Next.js 13.5.11-tuxcare.18 is not affected by GHSA-2464-fhr4-w9xw because the vulnerable code (memory-related RCE in sharp library) is not present in the Next.js repository. Sharp is not bundled, vendored, or declared as a dependency in this version. The vulnerability only manifests when users separately install a vulnerable version of sharp (< 0.35.5). Later Next.js versions (lts-active, 16.3....", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:e0d17e5c-aba0-535f-9442-2fa16d4ceb86", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:7f14ad93-37e2-5e54-b778-453ca23dfb18", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:a0285fb7-86a2-5701-9406-05e3fda60aec", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 13.5.11-tuxcare.19 of next. not_affected \u2014 The target Next.js 13.5.11-tuxcare.20 is not affected by GHSA-5vj8-3v2h-h38v (path traversal RCE via unsanitized require()). The vulnerability was fixed in Next.js v5.1.0 (Feb 2018) by adding path normalization that rejects traversal sequences. Version 13.5.11 (Sep 2023) already contains this defense in normalizePagePath(), which compares posix.normalize(path) against the original and throws on...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:67728c3b-31ee-5f95-9042-5b3d978759a5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:1080804c-3044-5bde-a32d-43d42574aadb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:d64222c8-0b12-59d1-b711-dfc523bffcd9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:dc99a80a-bf76-5f7b-aa6c-f3c16eb27e44", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:44576c31-12eb-5f6b-899d-b7c7830b854d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mwv6-3258-q52c is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:98341ad0-706e-57ed-a54b-883b0fb88e77", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:39070fde-5370-5406-a58a-476ec8a02363", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 13.5.11-tuxcare.19 of next." } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ], "bom-ref": "urn:uuid:126dcbd7-c9cf-5cdf-a668-fcfbe8b1459a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 affects version 13.5.11-tuxcare.19 of next." } } ], "dependencies": [ { "ref": "pkg:npm/next@13.5.11-tuxcare.19" } ] }