{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:55b473ec-e84e-58fd-a70b-e6efcf90c784", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@15.5.23-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/next@15.5.23-tuxcare.4", "version": "15.5.23-tuxcare.4", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@15.5.23", "type": "library", "version": "15.5.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:09a22f4e-da44-5c8e-8a3b-ce74dc8fb106", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2017-16877 affects Next.js versions before 2.4.1, allowing directory traversal under `/_next` and `/static` paths. The target version 15.5.23-tuxcare.4 is not vulnerable. The fix was implemented upstream in Next.js 2.4.2 (June 2017, commit 43c447edd0c) via an `isServeableUrl()` validation function. The modern codebase (v15.5.23) has evolved to use the `send` library (v0.18.0) for static fil...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:95e03cbc-1fe5-5295-808f-c66223557c8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 Next.js 15.5.23-tuxcare.4 is NOT affected by CVE-2018-18282 (XSS in error pages). The vulnerability affected only versions 7.0.0 and 7.0.1 from 2018. The upstream Next.js project fixed this issue in version 7.0.2, years before the current version. The target inherits the fix from upstream - all dynamic content in the error page is rendered through React JSX which automatically escapes HTML to p...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:1e7c274a-7406-59a1-8e56-5f89d76c9e41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:8b8b9ccd-fbcb-553f-8d24-a84ccf77ec17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2020-15242 affected Next.js 9.5.0-9.5.3 due to a vulnerability in the bundled node-fetch 2.6.0 dependency. The target (Next.js 15.5.23-tuxcare.4) is not affected because it does not use node-fetch at all. Next.js evolved from using node-fetch (versions 9.x-12.x) to undici (versions 13.x) to native fetch API (versions 14.x+). The current version requires Node.js \u226518.18.0 and uses the native ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:03c63fbc-3197-5781-b507-3c02c6cda927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2020-5284 affects Next.js versions below 9.3.2 and involves a directory traversal vulnerability in static file serving. The target repository is Next.js version 15.5.23-tuxcare.4, which contains the upstream fix commit 1d6ffc39f7b2da55aec02da8dc53a24eab8a6c5d (authored by joe.haddad@zeit.co on 2020-03-26). This fix was part of the upstream release before any TuxCare work began. The modern c...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:abf925dc-c033-590e-bc9b-10568d547250", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target Next.js 15.5.23-tuxcare.4 is not affected by CVE-2021-37699. The vulnerability was fixed upstream in Next.js v11.1.0 (August 2021) through commits 8c3c2b7ea2c and 4ab41efdbfd, which added normalization of repeated slashes/backslashes to prevent open redirect attacks. Since the target version 15.5.23 is based on Next.js 15.x (released 2024), it inherently includes these fixes as part ...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:835bbf2e-3fc4-54d9-b378-94da348fda14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:c0be17f5-8390-5100-9837-3e871a5cdaaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:6d799985-81e6-5ab7-807f-5bebc6d0f67d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2022-21721 affects Next.js >= 12.0.0 with i18n functionality, causing DoS via requests to /${locale}/_next/ paths. The target version 15.5.23-tuxcare.4 is not affected because the fix was already present in the upstream Next.js release that TuxCare onboarded. The vulnerable pattern (missing validation to prevent adding default locale prefix to /_next/ paths) is not present in the target cod...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:1b3b4ec8-3f76-5cb7-83d5-58bf2aadd241", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 Target Next.js 15.5.23-tuxcare.4 is NOT affected by CVE-2022-23646 (UI Misrepresentation via malicious SVG). The vulnerability was fixed in upstream commit 8a55612c0d3 (Feb 16, 2022) which introduced the `dangerouslyAllowSVG` configuration defaulting to `false`, rejecting SVG images at the image optimizer level. This fix shipped in the upstream release and is present in the target. Additional p...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:ca393781-cee6-5f33-a971-6a36c0189d56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2022-36046 affects Next.js v12.2.3, causing unhandled promise rejections that can crash the server process. The vulnerability was in the on-demand-entry-handler.ts file where promises were created without proper error handling. The target version (15.5.23-tuxcare.4) contains the upstream fix that was shipped in v12.2.4 (commit 2b2c2acf6e6 by Tim Neutkens). The fix refactored promise handlin...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:11dfb310-d43e-57dc-99ef-48e517bea626", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:632083a4-7f56-5522-a36e-05bb1924ea97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:603248ae-5544-5756-9197-8efbf54008f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:850bde80-7e50-5896-9070-170537795cb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:bd05a9dc-d140-5084-9d64-6310542ef409", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:0f677348-047c-574c-a959-a7c4b203436a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47831 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:6cf4fbf4-1c6a-5b17-9933-3762be046414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:23fdf6c6-e7dc-57e1-baa1-32788cedc4a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2024-56332 (Server Actions DoS vulnerability) is NOT present in Next.js 15.5.23-tuxcare.4. The vulnerability allowed malformed Server Action requests to leave connections hanging indefinitely. The fix (tracking response closure state via _closed/_closedReason fields) was already shipped in the upstream Next.js v15.5.23 release, which serves as the base for the TuxCare branch. Fix commit bf9...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:631c67e2-5234-50fb-ab8d-13ac0116afd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:3319c06b-075d-5bd4-843d-4dba4c831c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:54db8b18-8065-5a70-8943-ad687c79bdcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2025-32421 is not present in this target. The vulnerability involved accepting and processing internal middleware headers (x-middleware-rewrite, x-middleware-set-cookie, etc.) from external HTTP requests, allowing attackers to manipulate server routing and response behavior. The upstream fix (commit 224ca189921 by Zack Tanner, 2024-12-03) added filterInternalHeaders() to strip these headers...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:835c9834-27f0-5120-8a13-7db0e00196aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target Next.js 15.5.23-tuxcare.4 contains the complete defense against CVE-2025-48068 (cross-origin access to dev server resources). The fix was shipped in the upstream Next.js release and consists of origin validation code in block-cross-site.ts that validates Origin headers and browser security headers (sec-fetch-mode, sec-fetch-site) before allowing access to internal dev endpoints (_nex...", "justification": "requires_configuration" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:9ebf3432-e1ce-5ee8-9fe7-ada0fec750ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2025-49005 affects Next.js App Router >=15.3.0 and <15.3.3. The target version 15.5.23-tuxcare.4 is NOT vulnerable. The vulnerability (cache poisoning where RSC payloads could be cached and served instead of HTML due to missing Vary headers) was fixed in upstream commit 5c8f6206b1b by Vercel engineer Jude Gao. This fix was already present in the upstream Next.js 15.5.23 release when TuxCare...", "justification": "code_not_present" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:faad6391-3590-57bf-baa5-42f308fe63d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:5b49ad7d-9951-5bc0-8b02-65b9bf691f70", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target Next.js version 15.5.23-tuxcare.4 is NOT affected by CVE-2025-55173. The vulnerability allowed attacker-controlled external image sources to trigger file downloads with arbitrary content by controlling the Content-Type header. The vendor fixes (commits c49b7b11e85 and 6b12c60c61e) are present in the target and were part of the upstream Next.js release before TuxCare maintenance began...", "justification": "code_not_present" } }, { "id": "CVE-2025-55182", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:194aa75d-4c86-547e-acf1-c80d483911e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55182 is fixed in version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:09803cbc-e177-5a0d-bb0b-b56a01809815", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2025-57752: Next.js Image Optimization cache key confusion vulnerability is NOT present in target version 15.5.23-tuxcare.4. The vulnerability involved forwarding user-specific request headers (Cookie, Authorization) to internal API routes during image optimization, causing personalized responses to be cached and incorrectly served to other users. The upstream vendor fix (commit 6b12c60c61e...", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:5af36ad2-65a1-5d5f-a4cb-9a0a17658d42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:dc60feb6-8193-55b1-882f-62b8409a0e1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59471 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target (Next.js 15.5.23-tuxcare.4) is NOT vulnerable to CVE-2025-59471. The vulnerability (unbounded image loading causing DoS via memory exhaustion) requires the image optimizer to load entire external images into memory without size limits. The fix (streaming with maximumResponseBody limit enforcement) was already shipped in upstream Next.js v15.5.10. The target version 15.5.23 includes t...", "justification": "code_not_present" } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:73a20c41-2f8a-580b-969c-3430e0445afc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:d9ac89d2-a086-5a12-940d-4d4b7dc7cb7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target version 15.5.23-tuxcare.4 does not support accessing root parameters from within 'use cache' functions. Both getRootParam() and unstable_rootParams() explicitly throw errors stating \"Support for this API inside cache scopes is planned for a future version of Next.js.\" The vulnerability requires inner cache functions to read root parameters\u2014a capability that is architecturally impossi...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:ab7f031f-e721-5846-9b08-d724afd1a573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:d4240866-2c51-5fb9-96e7-fcf623085d66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27978 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:56b6880c-dbe9-5410-bb45-4196185c8e0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27979 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:2d34e1a3-f16c-5a8f-878e-586ba1ef8d18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27980 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2026-27980 is NOT present in Next.js v15.5.23-tuxcare.4. The vulnerability (unbounded disk cache growth in image optimization) was fixed by the upstream vendor (Vercel/Next.js) before the v15.5.23 release. The fix introduces an LRU-backed disk cache with configurable size limits (`images.maximumDiskCacheSize`), automatic eviction of least-recently-used entries, and defaults to 50% of availa...", "justification": "code_not_present" } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:d6d27d07-9579-51a0-ae35-fede417201e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29057 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target Next.js 15.5.23-tuxcare.4 is NOT vulnerable to CVE-2026-29057. The vulnerability was fixed by upstream commit 15f28911fd2 which shipped in the upstream release before TuxCare's branch started. The compiled http-proxy code contains the fix: it checks both content-length AND transfer-encoding are undefined before adding content-length: 0, and no longer deletes the transfer-encoding hea...", "justification": "code_not_present" } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:8797e304-5c80-5d19-95a6-89f213ee53b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44572 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2026-44572 affects Next.js applications where external clients can inject the `x-nextjs-data` header to manipulate middleware redirect responses, potentially poisoning CDN caches with unusable redirects. The target repository (Next.js 15.5.23-tuxcare.4) is NOT AFFECTED because the upstream fix (commit ac51823b5b2e2beaf57faf78aef6031d0bae2bd5) was already present in the upstream release 15.5...", "justification": "code_not_present" } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:af9395e4-c44d-5373-9a07-86d69795d0c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:4ef8e3a4-bc1a-5b4e-b94f-be87977ba3df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:e4a5b28d-7f80-5713-a167-cf1bef594dcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:0b99c285-e861-58db-838c-b16b814f5b29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44576 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target (Next.js 15.5.23-tuxcare.4) is not affected by CVE-2026-44576. Both security patches that fix the cache poisoning vulnerability are already present in the target: (1) strict RSC header validation via isRSCRequestHeader() that only accepts literal string \"1\", and (2) strengthened cache-busting parameter using 96-bit SHA-256 hash with server-side validation. These fixes were applied by...", "justification": "code_not_present" } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:504d3abd-3615-541b-b903-b1c58a4adb2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44577 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target Next.js 15.5.23-tuxcare.4 is NOT affected by CVE-2026-44577. The vulnerability (unbounded memory consumption when loading large local images via /_next/image) was fixed by upstream vendor commits that shipped in the base release before TuxCare onboarding. Both required patches are present: (1) fetchExternalImage enforces maximumResponseBody limit via chunk-by-chunk size tracking (lin...", "justification": "code_not_present" } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:2f9cc3f4-fb51-5f37-ac82-713ff4fa91bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:797fd105-ec45-5ebc-aa96-3e03ceb59d25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 15.5.23-tuxcare.4 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:8d2787a7-f57f-5628-8d34-ba0d93f87e35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44580 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target repository is NOT vulnerable to CVE-2026-44580. The XSS vulnerability in beforeInteractive scripts has been fixed by upstream commit 086dfa7f8fd (authored by Josh Story) which was included in the upstream Next.js v15.5.23 release. This fix was already present when TuxCare onboarded the 15.5.23 version. The vulnerable pattern (unescaped JSON serialization in inline scripts) is absent ...", "justification": "code_not_present" } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:a4b96901-3b64-59d5-b102-ceb757e55270", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44581 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 The target repository is not vulnerable to CVE-2026-44581. The upstream fix commit 79d7dff1448 (authored by Vercel engineer jj@jjsweb.site) is present on HEAD and was included in the upstream release before TuxCare onboarded it. All defenses are in place: strict regex validation of nonce values and HTML attribute escaping at all nonce insertion points.", "justification": "code_not_present" } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@15.5.23-tuxcare.4" } ], "bom-ref": "urn:uuid:44ec6341-4ee0-52b3-a089-c01f82ff3556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44582 does not affect version 15.5.23-tuxcare.4 of next. not_affected \u2014 CVE-2026-44582 addresses cache poisoning in React Server Component responses due to weak collision resistance in the `_rsc` cache-busting parameter. The vulnerability allowed attackers to predict hash values and poison cache entries. The fix strengthened the hash from a simple hexHash (5 chars) to SHA-256 truncated to 96 bits (16 chars base64url). This fix was authored by JJ Kasper