{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:190bceb7-0e92-5e70-b4f9-1fe381f3786f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "next",
      "purl": "pkg:npm/next@14.2.12",
      "type": "library",
      "bom-ref": "pkg:npm/next@14.2.12",
      "version": "14.2.12",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-16877",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:5a261469-ee48-5ac8-84b6-a427dfae9248",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-16877 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2017-16877 describes a directory traversal vulnerability in Next.js versions before 2.4.1 affecting the `/_next` and `/static` request namespaces. The target repository is at version 14.2.12 (released in 2024), which is significantly newer than the affected version range. The fix for this vulnerability was implemented in the upstream Next.js repository on June 1, 2017 (commit 43c447edd0c) b...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-18282",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:56af9cb8-c38d-540c-83fc-54eaee0ba6c8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-18282 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2018-18282 affected Next.js 7.0.0 and 7.0.1 (October 2018) with XSS via unsanitized pathname injection into inline scripts on error pages. The vulnerability was fixed in upstream version 7.0.2 (commit e6d79bb88ee, October 11, 2018) by Tim Neutkens. Target version 14.2.12 contains this upstream fix - the vulnerable code pattern is not present. Verdict: not_affected with upstream fix attribut...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-6184",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:ec4a27ae-4c44-5bc6-9ba2-4075578952e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-6184 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2020-15242",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:f1881bed-bbdc-5ce2-862a-4b96011ce837",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15242 does not affect version 14.2.12 of next. not_affected \u2014 Target Next.js v14.2.12 is not affected by CVE-2020-15242. The vulnerability affected Next.js v9.5.0-9.5.3 in the serverless-loader component, causing URL normalization inconsistencies that could lead to server-client hydration mismatches. The fix was applied in upstream v9.5.4 (Oct 2020) by Vercel engineer JJ Kasper, introducing proper URL path normalization with denormalizePagePath, resolvedU...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-5284",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:f7e9c3c1-2ac4-5bde-8955-a7e9a7507846",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-5284 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2020-5284 affects Next.js versions below 9.3.2 with a path traversal vulnerability in static file serving. The target repository (Next.js 14.2.12) contains the upstream vendor's fix (commit 1d6ffc39f7b) which was applied by ZEIT/Vercel in March 2020. The vulnerable code pattern has been replaced with an allowlist-based validation mechanism that prevents unauthorized file access via path tra...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-37699",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:83ac3ebf-7025-5d70-9937-59a6ecf154cd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-37699 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2021-37699 (open redirect via repeated slashes in URLs) is NOT present in Next.js v14.2.12. The vulnerability was fixed in upstream commit 4ab41efdbfd082 (v11.1.0, August 2021) by JJ Kasper, well before this v14.2.12 release. The fix detects URLs with repeated slashes/backslashes and normalizes them before routing, preventing external redirects. This upstream fix shipped with the v14.2.12 r...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-39178",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:cec0bde5-ca90-51a3-9d4b-cdc60c3992f8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-39178 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2021-43803",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:8d690d40-d49a-541f-ac8b-4c93df64a832",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-43803 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2022-21721",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1e05df9f-2efe-5fc4-be71-371e16564349",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-21721 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2022-21721 describes a denial of service vulnerability in Next.js >= 12.0.0 when using i18n functionality, triggered by requests to /${locale}/_next/ paths causing infinite redirect loops. The target version (14.2.12) already contains the upstream fix (commit 69524c290d8) that was released in v12.0.9. The fix prevents the DoS through two mechanisms: (1) an internalRender flag that prevents ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23646",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:66d0020d-3a46-5445-b345-a9a6f20a8f75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23646 does not affect version 14.2.12 of next. not_affected \u2014 Next.js 14.2.12 is NOT vulnerable to CVE-2022-23646. The security fix introducing the `dangerouslyAllowSVG` configuration flag (default: false) was added in upstream Next.js v12.1.0 (February 2022) by steven@ceriously.com and is present in the target version. The defense rejects SVG image optimization requests by default, preventing potential UI misrepresentation attacks from user-provided SVG ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-36046",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:b948c943-eb9e-5dcc-83ea-424fb3c7630e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-36046 does not affect version 14.2.12 of next. not_affected \u2014 Next.js v14.2.12 is not affected by CVE-2022-36046. The vulnerability (unhandledRejection events crashing the server process) existed in v12.2.3 due to missing promise rejection handlers. The fix was introduced upstream in commit f57eecde5e1 (July 2023, first shipped in v13.4.12) and is present in v14.2.12 at packages/next/src/server/lib/start-server.ts:291. The process.on('unhandledRejection',...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46298",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:cf8e221b-a600-5daa-9fd6-8aeae5b5f430",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46298 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-34350",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:cb7fffe2-b22b-5bdf-80f4-e5a0ab3f163f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34350 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-34351",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:e2490862-22a1-5ebd-acde-686436879eeb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34351 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-39693",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:13afd9c0-590a-5b71-aae2-e80c8be8e582",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-39693 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-46982",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:8c3bcf2a-8657-5dec-9260-791ae3b5a14b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-46982 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-47831",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:71cd9f67-030d-5c7f-89e1-ce6e0f818e4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-47831 does not affect version 14.2.12 of next. not_affected \u2014 CVE-2024-47831 (DoS via recursive image optimization) is NOT present in Next.js 14.2.12. The upstream fix (commit d11cbc9ff0b) was shipped in v14.2.7 and is present in the target. The fix adds URL parsing and decoding to detect and reject recursive `/_next/image` references in relative URLs (lines 206-213 of image-optimizer.ts). A subsequent upstream commit (55e4ef2d2b7) refined the fix to allo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-51479",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:c81aebba-3a6d-5e1d-9ea4-ef84b87571fa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-51479 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2024-56332",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:809eecbb-55f9-5bb2-83a2-a765d2356095",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-56332 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-29927",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:9da719c9-2dbe-5717-910c-459a7d078d24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-29927 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-30218",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:01c7b34e-db9d-5a75-99de-7e10de3c61e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-30218 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-32421",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1852ea85-f542-57cf-affa-e17cd0c73997",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-32421 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-48068",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:15eb74b2-2099-51fb-96bf-9a3626aaccbc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-48068 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-49005",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:123b91fa-9d79-55ac-b851-41a21daea012",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49005 does not affect version 14.2.12 of next. not_affected \u2014 Version 14.2.12 is not affected by CVE-2025-49005. The vulnerability was introduced in version 15.3.0 by commit f2cf3dc8e42 which removed Vary header logic, causing RSC payloads to be incorrectly cached and served as HTML. Version 14.2.12 contains the proper Vary header mechanism (base-server.ts:1692-1719) that prevents this cache poisoning by ensuring RSC and HTML responses are cached separate...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49826",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:8362fd1e-d513-5540-93a4-f8960c62d9e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-49826 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-55173",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:6e9fdfba-bc77-5cd8-89d2-ead3e681f9ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55173 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-57752",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4f2ad50c-0659-53dd-b717-67b2b8339f5c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-57752 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-57822",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4c4c8089-7721-516c-8a65-e65e2139665e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-57822 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-59471",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:e06aa9b9-8063-5d5a-a4d0-6ee6f8560a53",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59471 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2025-59472",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4081e910-026d-56a9-830e-655440261215",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59472 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-103004",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:cee3b129-1c9b-5a66-9b04-21135a4c986b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-103004 does not affect version 14.2.12 of next. not_affected \u2014 Next.js v14.2.12 is not affected by CVE-2026-103004. The vulnerable Cache Components feature with the 'use cache' directive was introduced in v15.0.0 (commit cb85cd07dfb), which is 4,386 commits ahead of this version. The vulnerable file packages/next/src/server/use-cache/use-cache-wrapper.ts and the entire use-cache infrastructure do not exist in v14.2.12. Exhaustive searches confirmed no 'use...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27977",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:ad305f59-6296-5360-94e1-ec890ff279fe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27977 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-27978",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:ade23201-ea12-5a48-8d8a-a208f9987e25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27978 does not affect version 14.2.12 of next. not_affected \u2014 Target Next.js v14.2.12 (September 17, 2024) predates the vulnerability introduction by over one year. The vulnerable code pattern that bypasses CSRF validation by treating 'origin: null' as a missing origin (via `&& originHeader !== 'null'` filter) was introduced in upstream commit a99aaa9c on October 28, 2025. This commit attempted to prevent crashes from invalid URL parsing but inadvertently...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27979",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:ca5b44e6-232b-519c-b26b-75a15ad059ee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27979 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-27980",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4c1ca6a9-0367-5693-a95e-9f5386871e55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27980 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-29057",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:906b08d3-a62d-5166-ab9a-3f7cc1e4346d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29057 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44572",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:7483fa98-cbe5-5607-8c78-763367ac54a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44572 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44573",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:6e883eb8-c1ee-5146-99d4-186588adc0c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44573 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44574",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:efdd8f8a-8ab2-50e4-9eb7-18e507a25d17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44574 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44575",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4c8793e7-ee20-5bf9-9988-d7f131843a01",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44575 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44576",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:74101f71-5673-5b4d-8264-77e81b4e96e5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44576 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44577",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:2a55e0cc-fb02-5b3e-b016-0f3ff4a48513",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44577 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44578",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1c582b38-ced9-547b-9ccd-d6d007544eeb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44578 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44579",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:80a665f1-c2d8-5c7d-a7a1-fd629da57781",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44579 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44580",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:e468e9e2-9201-5e89-a1e1-a16638e47e33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44580 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44581",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:bb04b153-fc84-5398-888f-fb55b3e5a3c5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44581 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-44582",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:2e8289e9-8670-50c7-bed8-deb4a8c0a2ff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44582 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-45109",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:12275afe-e367-598c-97c1-1ba30e569e17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45109 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64641",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:842730c8-71ce-554a-b000-162e31c0c83e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64641 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64642",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:f0efc929-f4e9-51ab-8a0d-57b32e19517f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64642 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64643",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:6e9277c7-c9e0-534e-acb8-43a2a4258801",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64643 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64644",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:8fa6d8a2-1356-5b3c-89e0-27ef39dbf12d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-64644 does not affect version 14.2.12 of next. not_affected \u2014 Next.js v14.2.12 is not affected by CVE-2026-64644. The vulnerability exists in v15+ where detectContentType() uses an expensive sharp.metadata() fallback for content type detection. v14.2.12 uses a completely different, simpler implementation with synchronous magic-number checking only, without any sharp metadata parsing during content detection. The vulnerable code pattern was introduced in l...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-64645",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:7b33b181-6a50-5afb-931e-4c780bb9e494",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64645 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64646",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:2505d7b5-ce0c-57ce-91e7-3c261d1e6498",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64646 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64647",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:91f088c1-a0e2-5a08-9de0-9a2b3ae08a0f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64647 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64648",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:20cbc562-a31f-55ec-97a6-68aa6add7d48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64648 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-64649",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:c5f0dc9e-b00b-52fc-891a-a993a2856ba5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-64649 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-75604",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:140268ed-f622-5b93-980e-505ffec43812",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-75604 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94482",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4be944dd-bdcb-50f9-b440-7852ae7a7311",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94482 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94483",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:6b8e662d-7e16-520d-9035-53047426a26e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94483 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94484",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1a3704ab-b1b8-57b7-aa12-62aa96d2f900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94484 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94485",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1ce9ce6d-718a-5a80-a45d-15660915facb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94485 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94486",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:cee91df3-0749-5564-a3e0-8fdb658187da",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-94486 does not affect version 14.2.12 of next. not_affected \u2014 The target Next.js version 14.2.12 is NOT AFFECTED by CVE-2026-94486. The Model Context Protocol (MCP) endpoint feature, which is the subject of this vulnerability, was introduced in Next.js v16.0.0 (September 2025) and does not exist in version 14.2.12. Both files modified by the security patches (packages/next/src/server/mcp/get-mcp-middleware.ts and packages/next/src/server/lib/router-utils/...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-94543",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:4751bec7-3954-55cd-a211-684b9d8f1ed6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94543 affects version 14.2.12 of next."
      }
    },
    {
      "id": "CVE-2026-94544",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:b64abe7f-ac9d-5e9d-bdbe-564966b5fc08",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-94544 does not affect version 14.2.12 of next. not_affected \u2014 Next.js v14.2.12 is not affected by CVE-2026-94544. The vulnerability exists in the `'use cache'` feature's cross-request deduplication logic, but this feature was not introduced until v15.0.0. Version 14.2.12 predates the vulnerable feature entirely\u2014the `use-cache-wrapper.ts` file, the `skipCrossRequestDedupe` mechanism, and the `experimental.useCache`/`cacheComponents` configuration options d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-2464-fhr4-w9xw",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:eb8ec8ab-7de6-59f6-ad8d-15c6bcb1244d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 14.2.12 of next. not_affected \u2014 Next.js 14.2.12 does not declare or bundle the sharp library. The vulnerability (GHSA-2464-fhr4-w9xw) exists in the sharp npm package (versions < 0.35.5), not in Next.js code. While Next.js's image optimizer can optionally use sharp if installed, sharp is not declared as a dependency in package.json, not vendored in the repository, and has a safe fallback (Squoosh). The upstream fix commits (95...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "GHSA-2xp9-vwfh-vxw4",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:e0b4eb16-9523-5375-b52f-8871799c36d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-5j59-xgg2-r9c4",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:12379deb-9639-53f8-99a8-caab8363344c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-5vj8-3v2h-h38v",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:9a3ee956-eb98-53ae-8f3d-0d977b6770d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 14.2.12 of next. not_affected \u2014 GHSA-5vj8-3v2h-h38v (RCE via unsanitized page paths in require()) is not present in Next.js 14.2.12. The vulnerable pattern was removed by an upstream fix in 2022 (commit 0c95a93858f1), long before this version was released. The target contains the normalization defense in normalize-page-path.ts that validates page paths and prevents directory traversal attacks by checking that posix.normalize(...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-673q-mjm6-r5xr",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:fe3d449e-29be-50ec-9d6c-54c075b999f2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-8h8q-6873-q5fj",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:9fba2a8f-97bf-57da-9485-9767d1fb5e16",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-9qr9-h5gf-34mp",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:edbadcc1-e622-5888-9a54-35a3f4cafdb2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-h25m-26qc-wcjf",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:94407304-6b52-5ed6-913c-334577843ae4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-mwv6-3258-q52c",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:1a55e4dd-0797-58fd-8abd-66b5762891d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-q4gf-8mx6-v5v3",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:6d9d1486-adb8-53a6-b39e-ca4c3d8b2063",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-vcvr-r3jv-pc5j",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:38122dd9-a137-57c4-b922-0a17cceb0866",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 14.2.12 of next."
      }
    },
    {
      "id": "GHSA-w37m-7fhw-fmv9",
      "affects": [
        {
          "ref": "pkg:npm/next@14.2.12"
        }
      ],
      "bom-ref": "urn:uuid:bf4079b6-c0ad-55f4-a7e9-201fc696f82c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 affects version 14.2.12 of next."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/next@14.2.12"
    }
  ]
}