{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b77afc84-185a-5204-8e35-ec7e735e1b7e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@15.5.24-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/next@15.5.24-tuxcare.2", "version": "15.5.24-tuxcare.2", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@15.5.24", "type": "library", "version": "15.5.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:f62b8b02-0dca-5e1d-90cc-151374227d6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Next.js version 15.5.24 is NOT affected by CVE-2017-16877. The directory traversal vulnerability under `/_next` and `/static` namespaces is blocked by the compiled `send` library's built-in path traversal protection. The `send` library checks all paths for `..` sequences using regex `/(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$)/` and returns a 403 error when detected. This protection is enabled by default and c...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:9c831659-2530-5a81-8562-e0b9cd09c964", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2018-18282 affects Next.js versions 7.0.0 and 7.0.1 from 2018. The target repository is Next.js 15.5.24 (released in 2025), which is 8+ major versions newer. The vulnerable code pattern from the 7.0.x era is not present in the current codebase. The error page implementation now uses React's automatic XSS escaping for all user-controlled data, and proper URL decoding error handling was added...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:645ca352-7029-5e27-874e-01c5db304756", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:044ed08c-3869-5db5-ae49-ea8724935d56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2020-15242 affected Next.js 9.5.0-9.5.3 due to a vulnerability in the node-fetch dependency (version 2.6.0). The target version 15.5.24 is not affected because node-fetch was completely removed from Next.js production code in favor of Node.js's native fetch (undici). The removal occurred in upstream commit 9477b61b517 (August 2023), which is part of the upstream v15.5.24 release. The vulner...", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:f3c5b7ca-8fb6-5712-9a57-2a06e8d9c442", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Version 15.5.24 is not affected by CVE-2020-5284. The vulnerability was a path traversal issue in Next.js versions prior to 9.3.2 that allowed attackers to access files outside the intended static/public/.next directories using specially crafted URLs with path traversal sequences (e.g., `/_next/static/../BUILD_ID`). The fix was committed to the upstream Next.js repository on March 26, 2020 (com...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:91a7970b-ff58-5a4c-b0e7-cdd4f58b6094", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2021-37699 (open redirect via repeated slashes) does NOT affect Next.js 15.5.24. The vulnerability pattern is not present because the upstream fix (commit 4ab41efdbfd, PR #27738 \"Add handling for repeated slashes\") was applied by JJ Kasper in August 2021 for Next.js v11.1.0. The target version 15.5.24 inherited this fix from the upstream release that TuxCare onboarded. The defense is fully ...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:7131443d-315c-5a23-8e6b-8626e9263316", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:8a367a1b-7cdf-537a-ad00-3c7b446d3623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:dc542fc4-8c2e-5915-a3f5-dae9cbce6acc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2022-21721 affects Next.js >= 12.0.0 with i18n enabled, causing DoS via locale-prefixed `/_next/` paths. The vulnerability was fixed in Next.js 12.0.9 (commit 69524c290d8c72) by adding an `internalRender` flag to prevent infinite recursion when processing `/${locale}/_next/` requests. Target version 15.5.24 contains this upstream fix, which shipped in the base release before TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:24e148d9-a921-5180-a388-15e29bced891", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2022-23646 (UI Misrepresentation via malicious SVG files) is NOT present in Next.js 15.5.24. The vulnerability affected versions 10.0.0-12.0.10 and was fixed in upstream 12.1.0. The target contains an upstream fix (commit 8a55612c0d3, PR #34431) that blocks SVG image serving by default through a `dangerouslyAllowSVG` configuration check. When an SVG is detected (via magic-byte content inspe...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:7cf9de53-b073-5ee5-9514-ed56e669455f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2022-36046 affects Next.js v12.2.3 where unhandled promise rejections crash the server process. The target version (15.5.24-tuxcare.4) contains the upstream fix that installs non-crashing unhandledRejection handlers in installProcessErrorHandlers() (next-server.ts:165-244). The fix was shipped in the upstream release v15.3.1-canary.10+ and is present in HEAD. The vulnerable pattern (no hand...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:4c1ff800-188c-5be6-9652-a9faf8c1bd10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:091fe6ff-db16-5252-af80-b1b603f2a154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:b6e3fc12-a802-5db9-9f70-e1393d056b87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:96a850aa-6ad3-506a-aba7-040a82a4a2ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:f3a5f45a-d4d7-5d2b-9aaf-a3bdb67c644e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:aa3a6c6d-9632-51b8-b138-c74b76147971", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47831 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2024-47831 (DoS via recursive image optimization) is not present in Next.js 15.5.24-tuxcare.4. The upstream fix (commit 4e0790fd6fa by Jiachi Liu, Aug 8 2024) was already included in the v15.5.24 release that TuxCare onboarded. The fix adds robust validation to reject recursive `/_next/image` URLs including encoded (%2F_next%2Fimage), absolute (https://domain/_next/image), and asset-prefixe...", "justification": "code_not_present" } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:0c86bfd9-410d-501a-85d0-949928fa1cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:5ae6cdb8-ec0c-5359-8e16-294fbc71e191", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2024-56332 is not present in Next.js 15.5.24-tuxcare.4. The vulnerability (DoS via hanging Server Actions requests with invalid Content-Length or never-closing connections) was fixed in upstream Next.js 15.1.2 (December 2024) via React PR #31840. The target version 15.5.24 (August 2026) is substantially newer and includes the upstream fix in commit bf9f0843edab \"Sync DoS mitigations for Rea...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:30fd6b28-9e15-57ec-876e-c59af05b55ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:399d0a1a-657a-5167-aace-67ed6bf1a8e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:f201803e-1c12-59d7-a822-6d80befafb6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2025-32421 describes a race-condition vulnerability in Next.js Pages Router where endpoints could serve JSON pageProps data instead of HTML. The core vulnerability mechanism involves external manipulation of the `x-nextjs-data` header to force JSON responses. The target v15.5.24-tuxcare.4 is NOT affected because the upstream v15.5.24 release already includes the `filterInternalHeaders` defe...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:e27c6e67-10f0-59db-a911-bdb40c740c04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js 15.5.24-tuxcare.4 is not affected by CVE-2025-48068. The vulnerability was fixed in upstream Next.js version 15.2.2, and the target version 15.5.24 includes this upstream fix. The defense mechanism (blockCrossSite function with allowedDevOrigins configuration) is present and correctly integrated into the development server's request handling pipeline.", "justification": "code_not_present" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:0a7fb963-20af-57e1-91ee-f19b3e8502c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49005 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:2a335719-bb03-5b4b-9b44-ee829a292d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:504403c3-a275-51d6-8192-1b96ed24eca4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2025-55173 is not present in Next.js v15.5.24-tuxcare.4. The vulnerability allowed attacker-controlled external image sources to serve arbitrary non-image content by manipulating Content-Type headers. The upstream fix (commits 6b12c60c61e and c49b7b11e85 by Steven, July 2025) was already present in the upstream release v15.5.24 before TuxCare onboarding (first TuxCare commit f4312f6efcfd, S...", "justification": "code_not_present" } }, { "id": "CVE-2025-55182", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:92ce296a-d75b-5f44-8b52-865a655563aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55182 is fixed in version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:5eecfc90-c1e3-59a8-af87-e4c279604de4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js repository (v15.5.24-tuxcare.4) is NOT vulnerable to CVE-2025-57752. The vulnerable code pattern (forwarding request headers in internal image optimization) is not present. The upstream fix (commit 6b12c60c61e by steven@ceriously.com) that removes the `headers: _req.headers,` line from the `fetchInternalImage` function was already included in the upstream release before TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:591a3ef2-992d-5139-b144-a3af5918a13b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:1467c8be-dd5c-5093-bcd2-ea910640f270", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59471 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2025-59471 fix was shipped in upstream Next.js v15.5.10 (commit 39a2f6a8d13 by steven@ceriously.com). The target repository v15.5.24 onboarded this upstream release with the fix already present. The vulnerable pattern (unbounded memory loading via `await res.arrayBuffer()`) has been replaced by chunked streaming with size enforcement (`totalSize > maximumResponseBody` throws HTTP 413). The ...", "justification": "code_not_present" } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:42ab3215-b64f-56de-abc8-a2cec0c02938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:7db035c8-0f6d-5cff-8564-075b5e4a6777", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Target version 15.5.24-tuxcare.4 does not support accessing root parameters inside 'use cache' functions, which is a prerequisite for CVE-2026-103004. The target throws an explicit error when root param getters (like lang(), countryCode()) are called within cache scopes. This feature was only introduced in commit 8283b1260ba (March 2026), which is not in the target's ancestry. The vulnerability...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:71e69920-388d-5d30-98e8-744f2a1d4492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:cf5734f4-baa5-58da-a003-bef23b68e14d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Target version 15.5.24-tuxcare.4 is not affected by CVE-2026-27978. The vulnerability was introduced in Next.js v16.1.0 (commit a99aaa9c423, Oct 2025) when code was added to explicitly check `originHeader !== 'null'` and treat it as undefined. The target predates this change. When Origin: null is sent to v15.5.24, the code attempts `new URL('null')` which throws TypeError, preventing Server Act...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:8a22389a-c8ee-5f64-97bf-52753c345e35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27979 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js 15.5.24-tuxcare.4 is not affected by CVE-2026-27979. While the vulnerable unbounded body buffering code exists in base-server.ts (lines 1087-1091), it is protected by a runtime defense that strips the `next-resume` header before request processing. The defense was introduced in upstream commit 04c5b6437ce (May 2026) and shipped in the upstream release prior to TuxCare onboard...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:e7c05a7b-9065-57f2-8dcd-ac8686092647", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27980 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target repository (Next.js 15.5.24-tuxcare.4) is NOT AFFECTED by CVE-2026-27980. The vulnerability pattern (unbounded disk cache growth in image optimization) is not present because the fix was already included in the upstream release that TuxCare onboarded. The LRU-backed disk cache with `maximumDiskCacheSize` configuration was added by upstream commit 2b0525123245da5b1b9d1abedc636c5fd3ee1...", "justification": "code_not_present" } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:deb4d112-540c-5707-93cd-b1ec4e7d7ba5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29057 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The CVE-2026-29057 fix was already present in the upstream Next.js 15.5.24 release that TuxCare onboarded. The fix commit (15f28911fd2) by Zack Tanner from GitHub predates the first TuxCare commit (f4312f6efcf) in this branch's history. Both the patch file (patches/http-proxy@1.18.1.patch) and the compiled http-proxy code (packages/next/src/compiled/http-proxy/index.js) contain the security fix...", "justification": "code_not_present" } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:0c54b615-bfde-553e-858f-d8f3de0b90ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44572 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target is not affected by CVE-2026-44572. The vulnerability (external header injection causing redirect response poisoning) was fixed in upstream Next.js commit 85533bb024d authored by JJ Kasper (jj@jjsweb.site) from Vercel. This fix was already present in the upstream release before TuxCare began maintaining version 15.5.24-tuxcare.4. The fix validates request PATH structure (/_next/data/*...", "justification": "code_not_present" } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:797118c1-2270-5b73-9491-16b7f9d5cff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:e0876f36-8294-5a7e-8adc-8ccb79006bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:cd7f437c-5a19-5ab7-824f-75efd88a074c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:9221bfe8-fcb3-5e9b-b8b2-c6fc0d77cd24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44576 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Target is not affected by CVE-2026-44576. Both required fixes (strict RSC header validation and collision-resistant cache-busting) were already present in the upstream Next.js v15.5.24 release before TuxCare onboarded this version. The vulnerability patterns do not exist in the target because upstream Vercel engineers (Zack Tanner, JJ Kasper) shipped the fixes in v15.5.24, and TuxCare's first c...", "justification": "code_not_present" } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:a52970ff-0708-53f9-84db-b98f1e569392", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44577 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2026-44577 describes an OOM vulnerability in Next.js image optimization where local images are fetched into memory without size limits. The target (Next.js 15.5.24-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in the Next.js 15.5.24 release that TuxCare onboarded. Three fix commits (cd46de3bb14, 39a2f6a8d13, e5b834d208f) authored by steven@ceriously.com impl...", "justification": "code_not_present" } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:4feab703-ad3a-5e62-8c9f-36341e21cb9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:22d1c510-dd6b-5e78-9f9e-3884f162266e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:b7892be9-2a6e-5406-a17b-c3a4d8a1608a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44580 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2026-44580 describes an XSS vulnerability in Next.js `beforeInteractive` scripts where serialized script properties were not HTML-escaped, allowing attackers to break out of inline script context via values like ``. The fix wraps JSON.stringify output with htmlEscapeJsonString() before embedding in dangerouslySetInnerHTML. The target repository (Next.js v15...", "justification": "code_not_present" } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:50e9b94f-a86b-5965-be14-76248f85b42f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44581 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target repository (Next.js 15.5.24-tuxcare.4) is NOT AFFECTED by CVE-2026-44581. The vulnerability fix (commit 37ed48a65c9) was already present in the upstream release that TuxCare onboarded. The fix prevents stored XSS through malformed CSP nonce values by: (1) validating nonces against a strict base64-like regex and rejecting malformed ones, and (2) HTML-escaping nonce values before embed...", "justification": "code_not_present" } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:72d748a2-b542-5945-9a31-0c3d806b9210", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44582 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target repository (Next.js v15.5.24-tuxcare.4) is NOT AFFECTED by CVE-2026-44582. The vulnerability involved weak cache-busting hashes (~20-bit) that enabled cache poisoning attacks via hash collisions. The upstream fix, which strengthens the hash from a short hexHash to a 96-bit SHA-256-based cryptographic hash, was already present in the upstream release v15.5.24 that TuxCare onboarded. T...", "justification": "code_not_present" } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:45606113-7178-5343-b6a0-0b3d21057145", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:2942dd0b-6459-5baf-be86-ce49c07ce44c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:aefe5b99-967e-5315-b6c2-85dc5b0617b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:6467b703-41a9-5e14-92ce-480ab527a44f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64643 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js 15.5.24-tuxcare.4 repository already contains the complete fix for CVE-2026-64643. The vulnerability (Server Action ID disclosure and insufficient validation) has been mitigated by upstream commit 6b282ebed7ebc14dd1ebb442afada27f5745bb36 which adds strict format validation (42-character length check via mightBeServerReferenceId()), error handling for malformed IDs (getInvalid...", "justification": "code_not_present" } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:6e882c5a-ca87-55c0-a7fd-9313e46bc7fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64644 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js v15.5.24-tuxcare.4 is not affected by CVE-2026-64644. The vulnerability (CPU exhaustion via malicious images processed by detectContentType with sharp metadata extraction) was fixed in upstream commit a098e54f224 by Vercel, which was already present in v15.5.24 before TuxCare began maintaining this version. The current code limits content-type detection to the first 1024 byte...", "justification": "code_not_present" } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:13dc3595-6d7e-5f26-b5f1-384eaade607c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64645 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:4c28004e-df93-503a-ae8d-a5c034ab7e37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64646 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js 15.5.24 is not affected by CVE-2026-64646. The upstream vendor fix (commit 744b8979f54) that enforces bodySizeLimit for Server Actions in Edge runtime was already present in the upstream release v15.5.24 before TuxCare onboarding. The fix adds body size validation (default 1 MB, configurable) to prevent excessive memory consumption from unbounded request body buffering in Edg...", "justification": "code_not_present" } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:202db405-83fb-5aba-909c-a719772ace77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64647 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js 15.5.24-tuxcare.4 is NOT AFFECTED by CVE-2026-64647. The vulnerability (UTF-8 decoding causing cache key collisions for different request bodies) is not present because the fix was already included in the upstream Next.js v15.5.24 release. The target contains the complete fix: hex encoding via toHex() for binary bodies, MAIN_KEY_PREFIX bumped to 'v4', tagged body chunks (byte...", "justification": "code_not_present" } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:5f34d9d0-9eb6-538f-be3c-4f86919d197c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64648 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target repository (Next.js 15.5.24-tuxcare.4) is NOT AFFECTED by CVE-2026-64648. The vulnerability pattern described in the CVE - where server-side fetch with different Request and init parameters causes cache key collision leading to response body leakage - has been fixed by an upstream vendor commit that was already included in the version TuxCare onboarded. The fix (commit 895fb84ea6150e...", "justification": "code_not_present" } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:e63ca027-58f2-5165-bf79-6b1beef0f418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:9a4e96db-dce3-59b6-a599-016846614d10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75604 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:22192af4-2540-5869-bec5-d3ee9395f8d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 15.5.24-tuxcare.2 of next, and is fixed in 15.5.24-tuxcare.5." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:4d43b001-243c-5d6e-b1fa-d688de47e1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:9474decb-6f5c-5a12-b631-1cad6b9412c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94484 is fixed in version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:812f3058-c846-5901-adcd-70ed9d808914", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94485 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js version 15.5.24-tuxcare.4 is not affected by CVE-2026-94485. The vulnerable code pattern (filtering out 'dynamicParams' from metadata route re-exports) was introduced in upstream commit ede8d1b8613 on Sep 5, 2025, which is AFTER the v15.5.24 release. The TuxCare repository is based on v15.5.24 which never contained this vulnerability. At HEAD, the reExportNames filter in next...", "justification": "code_not_present" } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:3bf330a4-55ff-54e1-b93a-3b792b6cb908", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 CVE-2026-94486 describes a DNS rebinding vulnerability in the Model Context Protocol (MCP) endpoint (`/_next/mcp`) of Next.js development servers. The MCP feature was introduced in Next.js v16.x (commit 58a60479550). The target version 15.5.24-tuxcare.4 does not contain the MCP feature, endpoint, or handler code. Without the MCP endpoint, the specific vulnerability described in this CVE cannot ...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:be0dc39d-075c-56d0-8186-5e641ced32f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94543 is fixed in version 15.5.24-tuxcare.2 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:bbbf5bde-5934-506b-b28a-1b536488cb61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 Target version 15.5.24 does not have the cross-request cache fill deduplication mechanism that the vulnerability exploits. The CVE describes draft mode content leaking between concurrent HTTP requests via shared pending cache fills, but this version uses request-scoped AsyncLocalStorage for cache isolation. Each HTTP request has its own isolated renderResumeDataCache, preventing cross-request s...", "justification": "code_not_reachable" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:d103fe92-5f25-530c-bef6-bf8c32add9d4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2464-fhr4-w9xw affects version 15.5.24-tuxcare.2 of next, and is fixed in 15.5.24-tuxcare.4." } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:5beaa470-12e1-5b55-91a9-e4d3e641e042", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js repository (version 15.5.24-tuxcare.4 at SHA 3c67cc5b0d2) is NOT AFFECTED by GHSA-2xp9-vwfh-vxw4. The vulnerability in libheif (used by sharp for AVIF image optimization) that could lead to RCE is mitigated by an upstream fix (commit 409772ec807) authored by Vercel that was already present in the upstream release TuxCare onboarded. The fix disables AVIF optimization by: (1) a...", "justification": "code_not_present" } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:aecb895d-9671-51fa-9150-7ee2c3814f47", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:2d9b1f36-abc3-5651-9998-029945436da7", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target repository (Next.js v15.5.24-tuxcare.4) is NOT affected by GHSA-5vj8-3v2h-h38v (Remote Code Execution via path traversal in page require). The vulnerability affected versions < 5.1.0 (fixed in February 2018). The target is 10+ major versions newer, and the fix was already present in the upstream v15.5.24 release (August 2026) that TuxCare onboarded. The security fix (path normalizati...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:63e90f7a-5dcb-55ab-ad50-9f2d4113fa0b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:87cb9cb3-4e59-5cba-8e85-b4a2c9b30b0e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:5b8e552b-ac19-5c55-927b-10cbcc92744b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:13d4943f-f9b8-5731-ae5b-8d80372627a0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:c1014bf0-133b-533b-b3e6-b5a343257dd4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:43083d89-7495-5733-b08a-52a512d47c93", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:38dde9c3-b70d-55dd-86b3-2b44ed9d3f0d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 15.5.24-tuxcare.2 of next." } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ], "bom-ref": "urn:uuid:9f3f197e-a338-5d8e-8523-f5b0c51c4fc2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 does not affect version 15.5.24-tuxcare.2 of next. not_affected \u2014 The target Next.js v15.5.24 is NOT affected by GHSA-w37m-7fhw-fmv9 (CVE-2025-55183). All required defenses against the Server Function source code exposure vulnerability were already included in the upstream v15.5.x release series, specifically in v15.5.8 (action-handler hardening) and v15.5.15 (RSC header validation), both predating the first TuxCare commit (September 2026) by many months. The...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/next@15.5.24-tuxcare.2" } ] }