{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:64d7eae1-09e7-54a9-8613-982f25617355", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@15.5.25-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/next@15.5.25-tuxcare.3", "version": "15.5.25-tuxcare.3", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@15.5.25", "type": "library", "version": "15.5.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:dc8d3953-6a77-533b-a47d-4dece77e7efb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2017-16877 affects Next.js before version 2.4.1. The target version 15.5.25-tuxcare.3 is not vulnerable. The directory traversal vulnerability was fixed in upstream Next.js version 4.2.3 (January 2018), and the fix has been present in all subsequent releases including 15.5.25. The current code uses the 'send' module with built-in path validation, and comprehensive security tests confirm pro...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:1f62d40b-e7ea-5e1c-be31-7de576b2547e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2018-18282 affected Next.js versions 7.0.0 and 7.0.1 with XSS via the error page. The target version 15.5.25 is not affected because React's JSX rendering automatically escapes all user-controlled data, including the hostname displayed on error pages. This built-in runtime protection prevents the execution of attacker-controlled JavaScript.", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:7f8eab4c-b1b6-5b9a-9fd2-0807d0b4d092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:47c45a55-e452-5a13-96b2-b2a8edfb6657", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2020-15242 affects node-fetch < 2.6.1, which Next.js bundled in versions 9.5.0-9.5.3. The target version 15.5.25-tuxcare.3 does not include node-fetch in its production dependencies - the library was upgraded to 2.6.1 in v9.5.4 (fixing the vulnerability) and later completely removed in v13.4.13 in favor of undici/native fetch. The vulnerable code pattern is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:ce933272-d671-5527-bd45-c84fe2357918", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2020-5284 does not affect this target. The vulnerability was fixed in upstream Next.js v9.3.2 (commit 1d6ffc39f7b from March 2020), and this fix was already present in the upstream release before TuxCare onboarded the project. The target version 15.5.25 contains the upstream fix commit in its ancestry, meaning the vulnerable pattern never existed in the TuxCare-maintained branch.", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:7c9a1a1d-89ad-50e1-989d-ea16493d4e7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2021-37699 affects Next.js versions 10.0.5-10.2.0 and 11.0.0-11.0.1, allowing open redirects via specially encoded paths containing repeated slashes (e.g., `//google.com`) when `pages/_error.js` was statically generated. The target version 15.5.25-tuxcare.3 is NOT affected because the upstream fix (commit 4ab41efdbfd by JJ Kasper) was shipped in Next.js v11.1.0 (August 2021) and inherited b...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:29e104a4-888e-5aae-834c-78c98027eba1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8fd390d0-e648-5572-8f83-6ad7cf6c45da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:44d58487-cca4-57af-8665-2eda09c267e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2022-21721 is not present in Next.js 15.5.25-tuxcare.3. The vulnerability was a denial-of-service issue affecting Next.js 12.0.0 through 12.0.8 when i18n was enabled, where requests to paths like `/${locale}/_next/...` would cause an infinite loop. The fix (commit 69524c290d8) was applied by upstream Next.js in version 12.0.9 (January 2022) and is present in the current version. The fix add...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:9d86ed12-920e-5b25-8f66-b7259e3175a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2022-23646 affects Next.js versions 10.0.0 through 12.0.10. The vulnerability allowed malicious SVG images from whitelisted domains to be served inline with executable JavaScript. The target (Next.js 15.5.25-tuxcare.3) is not affected because the upstream fix was already included in the release. The fix added three layers of defense: (1) SVG images are rejected by default via dangerouslyAll...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:5a2d7ccf-46af-5227-8c76-5e3d15fc2a3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 Next.js version 15.5.25-tuxcare.3 is not affected by CVE-2022-36046. The vulnerability affected version 12.2.3 and was fixed in 12.2.4. The target version is significantly newer and contains the upstream fix that prevents unhandled promise rejections from crashing the process.", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:345206a6-6344-5934-bfd3-8bd8f18c08f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:e6d75614-9c22-5a2d-8807-187e8269f9c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:5d81166f-91dc-58c6-a5af-c21b037cc64e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c175d72c-3a9c-548b-8112-93c408dbd5f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:e8c87a57-4eb4-5069-a8f3-93a79bcadd37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:99abd539-f642-56d8-8867-9654bb761f57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47831 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:ec1d1a83-9894-509d-bed6-a4a392a90cc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:e6a34508-f59b-5bbd-8e18-db3911a3f07e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2024-56332 affects Next.js Server Actions, allowing DoS via requests with malformed Content-Length headers or connections that never close, causing request body parsing to hang indefinitely. The vulnerability was fixed in Next.js 15.1.2 via React upgrade to version 65e06cb7-20241218 (December 18, 2024). The target version 15.5.25 (released August 31, 2026) uses React 0bdb9206-20250818 (Augu...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:dd44a8cb-07f6-5b77-9dfc-e72a6a2ec43a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:bb7c369a-8f64-551b-8217-bcb025913dbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:b5800bdd-03e7-5482-b66a-693111e685c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2025-32421 (race-condition vulnerability causing Pages Router endpoints to serve pageProps data) is NOT present in Next.js 15.5.25-tuxcare.3. The upstream vendor (Vercel) fixed this vulnerability in commit 224ca189921 (Dec 3, 2024) by implementing filterInternalHeaders() to strip internal middleware headers from external requests. This fix was already included in the upstream v15.0.4-canary...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:436a072f-9e39-5a65-afdc-3adf43100416", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2025-48068 is not present in Next.js 15.5.25-tuxcare.3. The vulnerability allowed cross-origin access to dev server internal resources (/_next/*, /__nextjs/*), enabling limited source code exposure when npm run dev was active. The fix was introduced in upstream Next.js v15.2.2 (commit d928709b749, March 2025) and is present in v15.5.25, which the target is based on. The complete defense imp...", "justification": "code_not_present" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:249be66f-7d10-55ee-85bb-40574f160892", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2025-49005 affects Next.js App Router versions >=15.3.0 and <15.3.3. The target version 15.5.25 is not affected because the fix was already present in the upstream release. The vulnerability involved missing HTTP Vary headers that could cause RSC (React Server Component) payloads to be cached and served in place of HTML responses. The fix adds proper Vary headers (RSC, Next-Router-State-Tre...", "justification": "code_not_present" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:f00f4e34-f2b6-52d9-bf89-edc4265289cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:9101def3-ac9e-5e0b-ad5b-77413a84cda1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2025-55173 is NOT present in Next.js v15.5.25-tuxcare.3. The vulnerability allowed attacker-controlled external image sources to trigger arbitrary file downloads (e.g., PDF) through the image optimization endpoint. The upstream vendor (Vercel/Next.js) fixed this in commits c49b7b11e85 (content-type validation) and 6b12c60c61e (header forwarding), which shipped in v15.4.2-canary.19. Both fix...", "justification": "code_not_present" } }, { "id": "CVE-2025-55182", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8d06cdec-72e8-5d94-b107-63d1d04b2221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55182 is fixed in version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:f1ddf46f-b42b-5a30-b9ea-f77866d33a81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js repository (version 15.5.25-tuxcare.3) is NOT AFFECTED by CVE-2025-57752. The vulnerable code pattern (forwarding request headers to internal image fetches, causing cache key confusion) is not present in the target. The upstream fix authored by Steven (steven@ceriously.com) in commit 6b12c60c61e was already included in the upstream Next.js release before TuxCare's onboarding,...", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:614efcd9-fb2f-54e9-ae7c-871df4b518cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:f7f74e9b-3d9a-570f-9ae3-a5dfb2dad1b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59471 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js v15.5.25-tuxcare.3 is NOT vulnerable to CVE-2025-59471. The vulnerability (DoS via unbounded memory allocation when loading external images) was fixed by upstream Vercel in Next.js v15.5.10 through commits 39a2f6a8d13 (adding maximumResponseBody config with streaming-based size enforcement) and e5b834d208f (reducing default from 300MB to 50MB). The target version (v15.5.25) i...", "justification": "code_not_present" } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:dd8da4ec-f0ed-5dd7-aed6-86f275cf1a24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c8dcc748-f228-51ce-aa17-b97b7c96a8a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target repository (v15.5.25-tuxcare.3) is not affected by CVE-2026-103004. The vulnerability requires the SharedCacheEntry class and cross-request cache deduplication architecture, which was introduced in Next.js v16.3.0 (April 2026, commit 1066fbf7a4d). The target is based on v15.5.25 (August 2026), from the 15.x branch that never received the v16.x SharedCacheEntry feature. While the `cac...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:26137547-1437-5299-9854-772c2c7be783", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:1a3e68a1-767d-5607-b3c3-45afee189736", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target (v15.5.25-tuxcare.3) is NOT affected by CVE-2026-27978. The vulnerability requires 'Origin: null' to be treated as \"missing\" origin, bypassing CSRF validation. In this version, the code attempts to parse 'null' directly as a URL (line 598: new URL(req.headers['origin']).host) without the intermediate '!== null' check that existed in vulnerable versions. This causes an uncaught TypeEr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:254b4b81-5735-587f-ab92-543b83e330e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27979 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:2b78f429-0186-556f-85ba-e990ec23b490", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27980 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.25-tuxcare.3 is NOT AFFECTED by CVE-2026-27980 (unbounded image optimization disk cache growth). The fix was already present in the upstream Next.js release that TuxCare onboarded. The vulnerability pattern (unbounded cache growth) does not exist because the target includes the LRU-backed disk cache with configurable maximumDiskCacheSize that evicts least-recently-used e...", "justification": "code_not_present" } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c51e3ff9-76e8-5c25-ba22-a711f994a431", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29057 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2026-29057 (HTTP request smuggling via Transfer-Encoding header manipulation in http-proxy) is NOT present in Next.js 15.5.25-tuxcare.3. The fix was already included in the upstream v15.5.25 release (March 2026) before TuxCare onboarded this version. The compiled http-proxy bundle contains both required fixes: the deleteLength function no longer deletes transfer-encoding headers, and setupO...", "justification": "code_not_present" } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c00c7661-7136-58b4-b235-713ee6af2254", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44572 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target repository (Next.js 15.5.25-tuxcare.3) is NOT affected by CVE-2026-44572. The vulnerability pattern (trusting external x-nextjs-data header to control redirect response format) is not present because the upstream vendor (Vercel) already fixed this issue in commit 85533bb024d, which was included in the upstream release before TuxCare onboarded it. The fix implements a two-layer defens...", "justification": "code_not_present" } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:deb9d6b4-2446-5457-a0da-4e669f162dc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:aba6015c-a528-54a8-85cc-ec09bbce935e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:789ab83f-6e96-5007-8ae8-9cba47344d1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:a2d24faf-499f-59cc-b69f-4e85a3d67502", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44576 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2026-44576 affects Next.js React Server Components through cache poisoning when shared caches don't partition response variants correctly. The target repository version 15.5.25 is NOT AFFECTED because both required fixes were already present in the upstream release v15.5.16, which TuxCare onboarded. The fixes include (1) strict RSC header validation rejecting malformed values, and (2) crypt...", "justification": "code_not_present" } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:845d4327-96be-5e42-80f1-db1281428904", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44577 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.25-tuxcare.3 is NOT AFFECTED by CVE-2026-44577. The vulnerability (unbounded memory allocation when loading large local images through the Image Optimization API) has been fixed by upstream Vercel commits that were already present in the upstream release onboarded by TuxCare. Both required defenses are implemented: (1) external image size limiting via chunk-based...", "justification": "code_not_present" } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:aeb98982-bec3-5c46-8b21-389686c2a538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:94c318e9-20b4-5b50-b8ab-5a23fb69788f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:47aeb608-5bbd-56b3-bc1a-ae4ffb5063a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44580 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.25-tuxcare.3 is NOT AFFECTED by CVE-2026-44580. The vulnerability (XSS via unescaped beforeInteractive script properties) was already fixed in the upstream Next.js release that TuxCare onboarded. The fix commit (ded7700913f by Josh Story @vercel) added htmlEscapeJsonString() wrapper around JSON.stringify() in script.tsx, preventing HTML injection through properti...", "justification": "code_not_present" } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:184300ea-e964-57f3-9274-ad62f3f9f1b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44581 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target repository (Next.js 15.5.25-tuxcare.3) is NOT AFFECTED by CVE-2026-44581. The vulnerability pattern (unsanitized CSP nonce values from request headers breaking out of HTML attribute context to enable XSS) does not exist because the upstream fix (commit 37ed48a65c9) was already present in the release that TuxCare onboarded. All four affected files contain the complete fix: strict base...", "justification": "code_not_present" } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:bf0e34c7-b177-54ff-955f-604f2f829fc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44582 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.25 is not affected by CVE-2026-44582 (cache poisoning via weak `_rsc` parameter). The vulnerability was fixed in the upstream Next.js release that TuxCare onboarded. The fix strengthens the cache-busting hash from ~5 characters to 16 characters (96-bit SHA-256), making collisions computationally infeasible. Fix commit ecc15e012c2 by upstream maintainer JJ Kasper was alre...", "justification": "code_not_present" } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c87168fc-5e30-5d44-8225-0ca201961e17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:45aecba3-716d-5824-9a52-55eaf690251b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:3f52c905-5199-50d2-96c4-6a774d9693ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c1fcb210-d246-5c00-b679-8d0e50b514b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64643 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.25-tuxcare.3 is NOT AFFECTED by CVE-2026-64643. The vulnerability relates to insufficient validation of Server Action IDs, which could allow exploitation through malformed identifiers or JavaScript property name collisions. However, the upstream Next.js project already fixed this vulnerability in version 15.5.24, and the fix was included in the v15.5.25 release that TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8f2a2604-8ef4-5d1d-97e5-31b0d589ea6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64644 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:06dc9bb5-c858-5a78-b5f8-cae2888cba8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64645 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:dc1b89f2-ba11-5453-8e0e-58820037f7f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64646 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2026-64646 affects Next.js Edge runtime Server Actions that fail to enforce body size limits, allowing excessive memory consumption. The target repository (Next.js 15.5.25-tuxcare.3) is NOT AFFECTED because the fix was already present in upstream v15.5.25. Commit 744b8979f54 by sebastian.silbermann@vercel.com introduced the fix before v15.5.24, making it part of the v15.5.25 upstream releas...", "justification": "code_not_present" } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:e3541028-644e-5e97-846e-f499f5c39062", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64647 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target repository (nextjs-project v15.5.25-tuxcare.3) is NOT AFFECTED by CVE-2026-64647. The vulnerability involved cache key collisions when binary request bodies with non-UTF-8 charsets were decoded using TextDecoder, causing distinct byte sequences (e.g., 0xff and 0xfe) to collapse to the same UTF-8 replacement character (U+FFFD) and share the same cache key. This allowed cached response...", "justification": "code_not_present" } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8611b376-365c-5f68-9137-b1912d6cc2c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64648 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2026-64648 describes a fetch cache key collision vulnerability where `fetch(new Request(url, init1), init2)` could return cached response bodies from different requests when init1 and init2 differ. The upstream Next.js v15.5.25 release already includes the fix (commit 895fb84ea61) authored by Vercel engineer Sebastian Silbermann. The fix merges init overrides into the Request input before c...", "justification": "code_not_present" } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:014ef4b4-f936-59be-b8f7-c6a0e4a649ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:22e2325e-5bb0-5ce5-9c6f-1c43b260b9d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75604 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:eab75965-b2ce-5565-a528-0fbd898c3bfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 15.5.25-tuxcare.3 of next, and is fixed in 15.5.25-tuxcare.4." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:ffd6affe-2951-5115-a17d-de7f1e985ade", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:92e20afd-97e7-5294-be81-97b43cced1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94484 is fixed in version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:703ffaef-5048-56ad-b5a1-8e8c15b22b37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94485 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 Next.js v15.5.25-tuxcare.3 is NOT affected by CVE-2026-94485. The target is based on upstream v15.5.25 (released 2026-08-31) which never contained the vulnerability. The vulnerable code pattern (excluding 'dynamicParams' from metadata route re-exports) was introduced later in canary branch commit ede8d1b8613 (2025-09-05) and is not present in the v15.5.25 stable release line. The target correct...", "justification": "code_not_present" } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:11a76cf4-c4d8-5be5-8211-5eb5a4fc62b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 CVE-2026-94486 targets the Model Context Protocol (MCP) endpoint at /_next/mcp in Next.js development servers. This endpoint was introduced in Next.js v15.6.0-canary.24 (commit 58a60479550, Sept 2025) and does not exist in the target version 15.5.25-tuxcare.3. The target is based on the 15.5.x maintenance branch which diverged from the main development line at v15.5.0, before MCP was added. Exh...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8e723490-ebae-5ba2-80cd-bf87235d0065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94543 is fixed in version 15.5.25-tuxcare.3 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:507d7828-4a0e-59fe-a0e6-8f3d7aabe26a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 Version 15.5.25 is not affected by CVE-2026-94544. The vulnerability concerns cross-request deduplication of pending 'use cache' fills, a feature that does not exist in this version. The target uses request-scoped caching via AsyncLocalStorage with no mechanism for sharing pending cache fills between concurrent requests, preventing the information disclosure path described in the CVE.", "justification": "code_not_reachable" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:9af5fe44-d54f-56bf-af66-bc138cf530d8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2464-fhr4-w9xw affects version 15.5.25-tuxcare.3 of next, and is fixed in 15.5.25-tuxcare.4." } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:a32330c9-1dab-5c8e-8981-21dc63be8824", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.25-tuxcare.3 is NOT affected by GHSA-2xp9-vwfh-vxw4 (libheif RCE vulnerability). The upstream fix by Vercel (commit d64c0d1e) shipped in v15.5.25 before TuxCare onboarding. The fix implements runtime libheif version guards (>= 1.23.2) that conditionally enable AVIF decoding only when safe, blocking the VipsForeignLoadHeif operation and bypassing AVIF optimization when th...", "justification": "code_not_present" } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:25f361a8-7185-56ef-b433-2bcd945eb292", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:4aa2690d-8f3d-52f1-9fb8-77046fcf7c43", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 Next.js 15.5.25 is NOT affected by GHSA-5vj8-3v2h-h38v (remote code execution via path traversal in page routing). The vulnerability pattern (unsanitized page path passed to require()) is not present because the upstream security fix shipped in the release that TuxCare onboarded. The fix (path normalization validation to detect traversal sequences) was introduced in upstream commit 0de109baab7 ...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:696f94ce-4b92-5595-86af-6878f4ccc69c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:10b4fe0f-f634-523e-a7b2-01c67c4b6a30", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:f8a92ecc-175f-52a1-8697-5c5f49824e56", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c489e064-c1a6-5936-96d4-ceaa6f32e8ef", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:2061a5bd-4efe-5bbd-b776-ad5f56182354", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:804c5ef0-2ec8-5bf1-9e20-771280ca6032", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:0c5c4055-2b0a-5f27-bfea-4f0781f97c1c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 15.5.25-tuxcare.3 of next." } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ], "bom-ref": "urn:uuid:b183a1d9-35b3-5846-a483-59e5132b80f9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 does not affect version 15.5.25-tuxcare.3 of next. not_affected \u2014 Next.js 15.5.25-tuxcare.3 is not affected by CVE-2025-55183/GHSA-w37m-7fhw-fmv9. The vulnerability allows crafted HTTP requests to expose compiled Server Function source code. However, comprehensive upstream fixes were applied in December 2025 (action ID validation via commit e01e589e181d) and May 2026 (RSC header validation via commit 484baf49a383), both predating TuxCare's September 2026 onbo...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/next@15.5.25-tuxcare.3" } ] }