{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2b5698f-e0da-5cc6-a471-d80b8a88fd58", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@14.2.35-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/next@14.2.35-tuxcare.9", "version": "14.2.35-tuxcare.9", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@14.2.35", "type": "library", "version": "14.2.35" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10095", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:c8778cc3-3f50-599f-a07e-5ad2b549c813", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10095 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "AIKIDO-2026-10755", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:4d1a8759-3216-50ff-9cc4-efb227886f12", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10755 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "AIKIDO-2026-10757", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:8e3af614-6808-59bb-87b9-e8b2f9c4263e", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10757 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "AIKIDO-2026-10758", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:4715fb24-49d3-5c3c-b7e2-df54184a7fbb", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10758 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "AIKIDO-2026-10762", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:a4c9523b-14bd-5d4f-a319-d6f4c932d7f6", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10762 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:c10b2c71-e5d8-5801-87dd-0de8b058a6bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2017-16877 affects Next.js versions before 2.4.1 (released January 2018). Target version 14.2.35 is far beyond the affected range and was onboarded by TuxCare in March 2026 with the upstream fix already present. The vulnerable directory traversal pattern does not exist in version 14.2.35's architecture, which uses the `send` library with built-in path normalization protection and `path.posi...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:52ec620f-00a5-5d21-8be0-bcba273c18f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2018-18282 affected Next.js 7.0.0 and 7.0.1 (October 2018) via XSS in the error page where user-controlled pathname was injected into inline JavaScript. The vulnerability was fixed in version 7.0.2 (October 11, 2018) by commit e6d79bb88ee which removed pathname from __NEXT_DATA__ and inline scripts. The target version 14.2.35-tuxcare.14 is 6+ years and 7+ major versions newer than the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:e8cf1b5a-6d99-5d12-aa67-085f22d3f3ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:e38005d6-a423-5132-a776-b5a34b28f38d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2020-15242 affects Next.js 9.5.0-9.5.3 due to node-fetch 2.6.0 lacking response size limits, enabling Denial of Service via memory exhaustion. The vulnerability was fixed in Next.js v9.5.4 (September 2020) by upgrading to node-fetch 2.6.1. Target version 14.2.35-tuxcare.14 is much later (13,804 commits after the fix) and uses node-fetch 2.6.7. The fix was authored by upstream (sakito21@gmai...", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f8e64c19-f62e-5983-811e-161133ad6c13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2020-5284 is a path traversal vulnerability in Next.js static file serving (fixed in v9.3.2). The target version 14.2.35 is NOT affected because the upstream vendor's fix commit (1d6ffc39f7b) was already included in the upstream 14.2.35 release that TuxCare onboarded. The fix adds proper URL decoding, whitelist validation against actual filesystem paths, null-byte checking, and path encodin...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d085c6db-186e-5d37-a81b-a841f2e37bb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Next.js 14.2.35-tuxcare.14 is NOT affected by CVE-2021-37699 (open redirect via repeated slashes). The vulnerability fix was already present in the upstream Next.js 14.2.35 release, applied by commit 4ab41efdbfd (JJ Kasper, Aug 2021). The fix adds normalizeRepeatedSlashes() to detect and redirect URLs containing repeated slashes or backslashes (e.g., //google.com, \\/\\/google.com) with a 308 sta...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:94462497-f2bc-539c-8d83-120ef56f8fd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f4db1c9e-5f9c-5523-a967-959934db027c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f5d70dc2-bb1d-523e-b5a9-bc1ff3f4cdc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2022-21721 (DoS via locale-prefixed /_next/ paths) is NOT present in Next.js 14.2.35-tuxcare.14. The vulnerability was fixed in upstream v12.0.9 (Jan 2022) via commit 69524c290d8, and this fix was already present in the upstream release before TuxCare onboarded version 14.2.35. The target version (14.2.35) is significantly newer than the patched version (12.0.9), and the defensive code (`!i...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:6201b72c-a2e2-5455-be1f-878249090ea6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The target repository (Next.js 14.2.35-tuxcare.14) is NOT affected by CVE-2022-23646. The vulnerability allowed malicious SVG images from external domains to be served through the image optimizer, enabling UI spoofing attacks. The fix, introduced in Next.js 12.1.0 (February 2022), added a `dangerouslyAllowSVG` configuration option that blocks SVG images by default. This security check is presen...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:c768b8b6-946d-5935-9302-0b79404a1a18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2022-36046 describes an unhandled reference error when accessing the URLPattern global in environments where it's not defined. The fix (checking typeof URLPattern !== 'undefined') was introduced in upstream Next.js v12.2.4 (commit de41597bc83, Aug 2022) and was already present in v14.2.35 when TuxCare onboarded it. The current implementation uses a defensive module (url-pattern.ts) that exp...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9c58b892-fa14-5b82-a639-794b791bf278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:3c642125-24aa-5ca7-974f-6eb74bc2b5c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9d29281f-67f8-5adc-bc16-527112efcbb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:363b8122-d28d-56f5-8ce3-f06b26bade86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:6f6267b7-00d6-5e81-8ee6-bd070bc1dd0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:02de72ec-3044-5112-a633-48afe2f5ef7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47831 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2024-47831 addresses a DoS vulnerability in Next.js image optimization that allowed unbounded recursive processing. The vulnerability was fixed in upstream Next.js via commits d11cbc9ff (Aug 8, 2024) and 55e4ef2d (Sep 4, 2024), which were already present in Next.js 14.2.35 when TuxCare onboarded it (commit 1aa1c626a by ddanylov@cloudlinux.com). The target repository contains the complete fi...", "justification": "code_not_present" } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:ce2887a3-566c-5861-ba0c-490431b0ec3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:279856f4-3b71-51e2-a35d-b85d21a723e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Next.js 14.2.35-tuxcare.14 is NOT AFFECTED by CVE-2024-56332. The vulnerability, which allows DoS attacks via malformed Server Action requests with incomplete/never-closing payloads, was fixed in upstream Next.js via a React dependency update (commit 8803d2b46e6, Dec 18, 2024) that added response closure tracking (_closed, _closedReason fields) to immediately error out pending chunks instead of...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:703a6707-6ab7-5dbe-9569-1cd2b1e34fc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:0811f7f4-1923-5a7b-82d7-1152fe4e134c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:5cd84806-be5d-5713-b89d-cb20252c2380", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The target Next.js 14.2.35-tuxcare.14 is NOT AFFECTED by CVE-2025-32421. The vulnerability pattern (accepting internal headers from external requests leading to routing state manipulation or response header leakage) is not present because an upstream fix was already shipped in Next.js v14.2.35 before TuxCare onboarded it. The fix (commit 5791cb6 by Zack Tanner) adds comprehensive filtering of i...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:140e216b-8b4c-5ead-83ac-5a1f16816e09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The target Next.js 14.2.35-tuxcare.14 contains the complete fix for CVE-2025-48068, which prevents cross-site requests to dev server internal endpoints (_next/* resources). The fix was shipped in the upstream Next.js 14.2.35 release and includes the block-cross-site.ts defense module integrated into router-server.ts. However, the defense operates in 'warn' mode by default (detecting but not blo...", "justification": "requires_configuration" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:35377ad2-ebd9-5d3f-b27d-3df8d55df3eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2025-49005 affects Next.js App Router versions >= 15.3.0 and < 15.3.3. The target version 14.2.35-tuxcare.14 is below the affected version range. The vulnerable code pattern introduced in version 15.3.0 is not present in this earlier version, which uses a different cache handling architecture. The cache in 14.2.35 stores both HTML and RSC payloads separately (as `html` and `pageData` in cac...", "justification": "code_not_present" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:aac6a82f-cd52-5cc4-af8a-955afd2e1703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:fe867bee-2c37-59d0-8d6a-d71f22f3301d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2025-55173 is NOT present in Next.js 14.2.35-tuxcare.4. The vulnerability allowed attacker-controlled external image URLs to serve non-image content (PDF, executables) with arbitrary filenames via Content-Disposition headers, enabling malicious file downloads. The upstream Vercel/Next.js team fixed this in v14.2.31 (July 2025) by: (1) enhancing detectContentType() to detect PDF/JXL/HEIC/JP2..." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:711bc156-b78f-5f2d-a4cb-f4ba30975c63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 14.2.35-tuxcare.9 of next. Fixed upstream in 14.2.31 (GHSA-g5qg-72qw-gw5v affects >=0.9.9 <14.2.31); this branch is 14.2.35. The upstream fix removes the `headers: _req.headers` forwarding in packages/next/src/server/image-optimizer.ts (vercel/next.js 6b12c60) and that line is absent here (still present on 13.5.11, where we shipped our own cache-key backport).", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:80de9db0-242d-5111-86d6-b83d0bba5a7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:7a3a0572-6c37-565b-97dc-72d5f7f00166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d9333b98-fd8a-5fbe-a317-b14a803b5fd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 14.2.35-tuxcare.9 of next, and is fixed in 14.2.35-tuxcare.11." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:13bff4d6-b3a7-5f90-8f1f-4265c8121710", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Next.js version 14.2.35 is NOT affected by CVE-2026-103004. The vulnerability affects the Cache Components feature ('use cache' directive) which was introduced in Next.js 15.x and does not exist in version 14.2.35. The vulnerable file (packages/next/src/server/use-cache/use-cache-wrapper.ts) and the entire use-cache subsystem are absent from this version. The root params tracking and nested cac...", "justification": "code_not_present" } }, { "id": "CVE-2026-23864", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:3a04795f-73a8-517a-8685-a4b2b4461db1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23864 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-23870", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:1f725930-cd0d-58aa-a180-42bca94a8dee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23870 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:88f53d68-5483-5a10-9e19-a3e92536ce69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:5c81932d-db82-5f10-8539-3687199e9f38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The target Next.js version 14.2.35-tuxcare.14 is not vulnerable to CVE-2026-27978. The current code at HEAD (SHA 3d67f80) differs from both the vulnerable pattern and the fix. When a Server Action request arrives with `Origin: null` (from sandboxed iframes), the code attempts to parse 'null' as a URL at line 489, which throws a TypeError. This error prevents the Server Action from executing, th...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9560a663-ac18-5b94-a1f1-79620bf935c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27979 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Version 14.2.35 is not affected by CVE-2026-27979. The vulnerability exists in Next.js 15.x+ where a non-minimal-mode handler in app-page.ts processes requests with the `next-resume: 1` header and buffers request bodies without size enforcement. This specific handler and the NEXT_RESUME_HEADER pattern do not exist in version 14.2.35. While this version does support PPR (Partial Prerendering), p...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:badffe9e-7f50-5e21-bcd1-e43c718d5190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:2d7b2153-fbee-54c7-9f72-c996cb1634d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:3ec32945-70c3-5dfe-866a-8cb0d4a45ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f676e8f1-e8eb-5c26-bec0-ab69f29449d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:3be0b232-3267-543d-b338-b755d4a43502", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:61c30ea1-74ff-5d64-b20d-ae27cf7698bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:83806516-f97c-52fe-bf10-9f6f2d99276d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44576 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:b0a97ab2-bb43-5452-a6ef-83277d61381f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d07614dd-8b62-51c0-95d2-100c92858594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:294a07a1-5af3-5d38-9d9b-d774cda2390a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:00d477ef-1d5c-5029-bac5-450852296c42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:ab421f91-a713-5809-99ff-89606f97f3e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d739077a-9ae2-5caa-ad5c-a30b96be6721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9cd7bd7e-40bb-5388-824e-876f57493233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d63b214a-ad39-5ad3-ad50-7df0c21466a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:657e18bb-8e61-50a5-a8e4-2cc9add68104", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:bd191d82-8b6d-52e0-89fa-bcf0a88c7d78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:a2e394c4-5851-5b27-b06d-255af4b6ee4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64644 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:7eca14c0-40bc-53f4-9724-81bc66e1ef8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9d2a6f99-c9a8-570b-85c0-09a627f12594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:278406c1-20f4-5eeb-bf61-8a8db0920685", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:2aa9a43d-f12c-5159-b96f-95ec0a2a0bdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:35525b33-4ee6-571a-be1e-d73ae47b51b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64649 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Target version 14.2.35 is not affected by CVE-2026-64649. The upstream vendor (Vercel/Next.js) introduced the __NEXT_PRIVATE_ORIGIN protection mechanism in version 14.2.0, which is present in this target. When using the framework's standard production mode (next start), this environment variable is automatically set, preventing the SSRF vulnerability by using a predefined origin instead of untr...", "justification": "code_not_present" } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:6f487e8e-15d4-5914-b8b2-2692582b4a8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d643367d-6ef6-55df-b23f-ca909ef85891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 14.2.35-tuxcare.9 of next, and is fixed in 14.2.35-tuxcare.16." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:b22e3c50-cf7c-5e94-8f59-7133f91e4802", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:0f302dd1-91b5-5184-bab7-745168c03208", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94484 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:02a22305-24bd-5e5d-aaa9-5dd0bf8acd92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94485 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 CVE-2026-94485 affects metadata image routes that ignore the `dynamicParams` setting. The vulnerability pattern (filtering `dynamicParams` from re-exports in the metadata route loader) is NOT present in Next.js 14.2.35-tuxcare.14. The target shipped with upstream commit 73f6b7dc056 (Oct 2024) which correctly re-exports `dynamicParams`, allowing the runtime to enforce 404 responses for unlisted ...", "justification": "code_not_present" } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f1f3c538-5043-570a-abb4-9d8e7d575b6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The Model Context Protocol (MCP) endpoint targeted by CVE-2026-94486 does not exist in Next.js version 14.2.35-tuxcare.14. The MCP feature was introduced in upstream v15.6.0-canary.24 (September 2025), significantly after this target version. While the target contains a related URL parsing flaw in block-cross-site.ts that the upstream patches address, the exploitation target (the /_next/mcp end...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:8d8a3142-c803-51ad-a55e-a6d8c03e57dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94543 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:bfa80515-8855-5406-a57c-af2410f334e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Next.js 14.2.35 is not affected by CVE-2026-94544. This vulnerability requires the 'use cache' / Cache Components feature, which was introduced in Next.js 15.x and does not exist in version 14.2.35. The target version predates the vulnerable code by over a year and thousands of commits. While version 14.2.35 does have the unstable_cache API, it already includes proper draft mode isolation check...", "justification": "code_not_present" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:3ed6c602-abd2-5cbe-9ff8-7abd44ab5ced", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2464-fhr4-w9xw does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 Next.js 14.2.35-tuxcare.14 is not affected by GHSA-2464-fhr4-w9xw. The vulnerability exists in the `sharp` library (version < 0.35.5), which is not declared as a dependency in this version. The target does not vendor, bundle, or require `sharp`. While Next.js code can optionally use `sharp` if a user installs it separately, the target repository itself does not contain the vulnerable code. The ...", "justification": "requires_dependency" } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:157e53a1-7d90-5768-b99f-6aed9dd63e07", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 affects version 14.2.35-tuxcare.9 of next, and is fixed in 14.2.35-tuxcare.10." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:38b99468-e4da-5a18-92e2-a00e98326ff8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:76c416ed-6947-5b51-bbe9-65a4757b1e52", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 14.2.35-tuxcare.9 of next. not_affected \u2014 The target Next.js 14.2.35 is NOT AFFECTED by GHSA-5vj8-3v2h-h38v (Remote Code Execution via unsanitized path in require()). The vulnerability affected versions < 5.1.0 and was fixed by upstream Vercel in February 2018 (commit c8da345765e). The fix adds mandatory path normalization that detects and rejects directory traversal attempts (../) before any require() call. This upstream fix was alrea...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:2a81f995-b533-5fce-96a2-48e208cfc647", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:9b49cd91-2744-5072-a0d3-ae42e86f91fd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:1def6e39-9277-52e9-87e4-c8fc545f5872", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:17a0391c-caef-54ac-aea2-2e15bdf30b4f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:a4bd8166-170a-5e54-8bd0-7e1ca1f8964f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:730f402f-60fe-54ad-9978-e8439cc4537a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:d8dc90ca-693d-56de-87bd-31eb6ecc275b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 14.2.35-tuxcare.9 of next." } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ], "bom-ref": "urn:uuid:f7135950-852a-5fc7-b346-e4be7eaf0050", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 affects version 14.2.35-tuxcare.9 of next." } } ], "dependencies": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.9" } ] }