{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6734e15c-3e3d-5e47-92d9-c52f00e9da7f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@15.5.26-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/next@15.5.26-tuxcare.3", "version": "15.5.26-tuxcare.3", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@15.5.26", "type": "library", "version": "15.5.26" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:f304d9d0-0f3e-59c3-a93c-3ec00d6b77ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2017-16877 (directory traversal in Next.js <2.4.1 under /_next and /static) is NOT present in target version 15.5.26-tuxcare.3. The vulnerability was fixed in upstream commit 02fe7cf63f6 (June 1, 2017, version 2.4.1) by adding path validation via isServeableUrl() that blocks traversal attempts. This fix shipped in the upstream v15.5.26 release that TuxCare onboarded, 37,722 commits after th...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:68c8dd0e-d417-50e7-8246-ebdfe27409e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2018-18282 affects Next.js 7.0.0 and 7.0.1 (XSS via error page). The target is version 15.5.26-tuxcare.3, which is ~8 major versions newer. The vulnerability was fixed by upstream Next.js in 2018 (likely v7.0.2). TuxCare inherited the fix when maintaining from v12.x onwards. The vulnerable pattern (unescaped URL rendering in error pages) is not present\u2014React JSX provides automatic escaping ...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:517af71e-bea3-5755-82eb-545c4853c531", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:29d0fe53-35c2-593a-9f64-9b1b7fbcb610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-15242 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b9f37e20-c89f-59b1-8b9c-9405913147c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target version 15.5.26-tuxcare.3 is not affected by CVE-2020-5284 (path traversal via malformed static file URLs). Production deployments use a whitelist-based validation mechanism that prevents access to files outside intended static/public directories. The upstream fix (commit 1d6ffc39f7b by joe.haddad@zeit.co from v9.3.2) was integrated into the upstream release before TuxCare onboarding...", "justification": "protected_at_runtime" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:1f50ed0a-e8d8-51d9-b25a-6a438309797a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Target Next.js version 15.5.26 is not affected by CVE-2021-37699. The upstream vendor (Vercel) fixed this open redirect vulnerability in commits 4ab41efdbfd and 8c3c2b7ea2c, which were already present in the upstream release before TuxCare began maintaining this version. The fix implements comprehensive server-side and client-side validation that normalizes repeated slashes and backslashes in U...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:d03f0555-6017-59d9-9978-f5f53c266349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:db01543d-27b6-5170-bb90-6088f7a1c8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:2e6c65dc-cca7-5cfc-bd60-e79d3862b5ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2022-21721 describes a DoS vulnerability in Next.js >= 12.0.0 when using i18n functionality, where specially crafted requests matching `/${locale}/_next/` could cause denial of service. The target version 15.5.26-tuxcare.3 is not affected because the upstream vendor (Vercel/Next.js) already fixed this vulnerability in commit 69524c290d8 (January 21, 2022) before TuxCare created this mainten...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:26f16a72-73b4-5820-8b37-114b8b777e56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2022-23646 affects Next.js 10.0.0-12.0.10 where SVG images from external domains could be served without security controls, allowing UI misrepresentation through embedded scripts. The target (Next.js 15.5.26) contains an upstream fix from commit 8a55612c0d3 (Feb 2022) that blocks SVG by default via dangerouslyAllowSVG=false. This defense was already present in the upstream release before Tu...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:82ee925b-7f69-5a59-8dfa-01be414b1b91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2022-36046 affected Next.js v12.2.3 where specific HTTP requests could cause unhandled promise rejections that crash the server process. The vulnerability was in packages/next/server/body-streams.ts where the endPromise lacked a .catch() handler. When connections were canceled (especially with edge runtime), promise rejections would go unhandled, triggering process crashes on Node.js v15.0....", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:c2e832ef-9489-511c-957e-e4d4458b9da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6c51e674-46c3-530d-aa6c-2ca49014d8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:93256a93-1a54-5ef8-b904-c5c236c437c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8586026f-a51c-5c9e-9597-5e4f0ee093b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:74c03840-3345-562a-a740-87514cc5a677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e7aa2c0d-f618-5d06-aa8c-296f5c6a5aca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47831 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target repository (Next.js 15.5.26-tuxcare.3) is not affected by CVE-2024-47831. The vulnerability (DoS via recursive image optimization requests) is not present because the upstream fix was already included in Next.js v15.5.26 before TuxCare onboarded it. The fix validates and rejects URLs containing `/_next/image` in their decoded pathname, preventing recursive optimization loops that cou...", "justification": "code_not_present" } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:7f240d52-2565-53d5-a613-e5ef609549d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e2f0cec5-8eb5-52f3-b098-6c2e81eb362f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56332 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2024-56332. The vulnerability fix was already present in the upstream Next.js v15.5.26 release that TuxCare onboarded. The fix (commit 983fd271ded) was authored by Vercel Release Bot and adds a response closure mechanism that prevents indefinite hanging when Server Actions encounter malformed requests. All three components of the defen...", "justification": "code_not_present" } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:28dcba9a-1017-5de6-8024-653aad5e45ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:2f39ce1f-5000-5db4-8ff6-51934f7ca06d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:3617e5ac-72ee-5204-a2b6-ed0930d0bc83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2025-32421 (race-condition causing Pages Router to leak pageProps data via injected internal headers) is not present in Next.js 15.5.26-tuxcare.3. The vulnerability fix was already included in upstream Next.js v15.5.26 before TuxCare onboarded this version. The fix consists of three defensive measures: (1) filterInternalHeaders() function that strips internal middleware headers (x-middlewar...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:5b2f009f-d568-5620-8aa2-682f070d7c20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2025-48068 affects Next.js versions before 15.2.2, allowing cross-origin requests to access dev server internal resources. The target version (15.5.26-tuxcare.3) is significantly newer than the fixed version and contains the complete upstream fix. The vulnerability pattern is not present because the fix was already included in the upstream Next.js release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e92afb9a-7eed-59a5-adf2-17a56da0ddc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49005 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2025-49005 affects Next.js App Router >=15.3.0 and <15.3.3, causing RSC payloads to be cached and served incorrectly in place of HTML. The target version 15.5.26-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream release before TuxCare onboarded it. The fix (commit 5c8f6206b1b by Jude Gao) reinstates proper Vary headers to prevent browsers from incorrectly reusi...", "justification": "code_not_present" } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4542d449-3c45-5276-85ad-532e674a8211", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:f598352a-bed0-55c8-8726-a62bec364e0a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26 is NOT affected by CVE-2025-55173. The vulnerability allowed attackers to inject commas into Content-Type headers (e.g., \"image/png, attachment; filename=malicious.exe\") to trigger arbitrary file downloads through the image optimization endpoint. The upstream fixes (commits 6b12c60c61e and c49b7b11e85) were already present in the Next.js 15.5.26 release that TuxCare o...", "justification": "code_not_present" } }, { "id": "CVE-2025-55182", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:032ea865-7d1f-5b7b-89a7-f06338034e21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55182 is fixed in version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:61247fa6-ca3d-5a2f-895d-cba71defaad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target version 15.5.26-tuxcare.3 is not affected by CVE-2025-57752. The vulnerable code pattern (forwarding request headers to internal image fetches) was already removed by upstream commit 6b12c60c61e (authored by Steven ) that shipped in the Next.js release before TuxCare onboarded this version. The image optimizer at packages/next/src/server/image-optimizer.ts:898-9...", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:59a2ef63-1d97-5843-ad6b-9e403eeb267f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:fb62af18-f6e1-5fbc-9a66-1751bea90a14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-59471 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2025-59471 does NOT affect Next.js 15.5.26-tuxcare.3. The vulnerability (unbounded memory consumption in image optimization due to loading entire images into memory without size limits) was fixed by the upstream Next.js vendor in v15.5.10 via commit 39a2f6a8d13. The fix introduces `images.maximumResponseBody` config (default 50MB) and streams image responses in chunks, aborting if size exce...", "justification": "code_not_present" } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:ef68857c-5be9-53c5-a488-62abf1a30580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:40b17c88-fdac-542e-bdd9-cf67dfb19d0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Version 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-103004. The vulnerability requires nested 'use cache' functions where the inner function reads root parameters (e.g., lang(), countryCode()). In this version, accessing root parameters within 'use cache' contexts is explicitly blocked with an error: \"Support for this API inside cache scopes is planned for a future version of Next.js\" (root-p...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:d6f3aa94-825d-56b3-8db4-83eafec76104", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27977 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:73094ea9-4d8a-5c25-8fe1-a51d67f5e541", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27978 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26-tuxcare.3 is NOT vulnerable to CVE-2026-27978. The vulnerable code pattern that treats `Origin: null` as a missing origin (bypassing CSRF validation) was never present in this version branch. The target uses older code (from 2023) that attempts `new URL('null')`, which throws a TypeError and causes the request to fail before any server action executes. While this is n...", "justification": "code_not_present" } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:f50b07bf-daba-58f6-b6e7-d5a705ca6f61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27979 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:3d1632c6-89bd-5727-a9c1-026aaeb6ec6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27980 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The vulnerability (CVE-2026-27980) concerns unbounded disk cache growth in Next.js image optimization. The target version 15.5.26-tuxcare.3 is NOT affected because the fix (LRU-backed disk cache with configurable size limit) was already present in the upstream v15.5.26 release that TuxCare onboarded. The fix commit (2b052512324) was authored by Zack Tanner (Vercel upstream developer) on 2026-03...", "justification": "code_not_present" } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:d0ffb7cd-9ad8-560a-91f5-b61dc7547e01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29057 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.26-tuxcare.3 is not affected by CVE-2026-29057. The vulnerability was fixed in upstream commit 15f28911fd2 by Zack Tanner (Vercel), which shipped in the upstream release before TuxCare onboarded this version. The fix prevents request smuggling by: (1) checking both content-length and transfer-encoding headers are undefined before adding content-length: 0 to DELET...", "justification": "code_not_present" } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e8350dea-98c1-5cd7-a713-a326d7bc8ed9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44572 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-44572. The vulnerability pattern (trusting external x-nextjs-data header to determine internal data requests) is not present in the target. The upstream fix by JJ Kasper (commit 85533bb024d) was already included in the upstream release v15.5.24 before TuxCare's onboarding. The fix implements two-layer defense: (1) filterIn...", "justification": "code_not_present" } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8d402bc6-cdcc-57e0-9ca5-ca6d831540e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:163dac9a-e79b-593c-a4c9-8abf85a34f2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44574 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b4ee1938-b9be-5639-b3ca-37e2b67fe6a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44575 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6cf3e6b4-d74a-542d-8a6a-ba2da6925064", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44576 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Target Next.js 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-44576 (RSC cache poisoning). Both required upstream fixes were already present in the Next.js 15.5.26 release that TuxCare onboarded: (1) strict RSC header validation via isRSCRequestHeader() that accepts only the literal string \"1\" and rejects arrays/malformed values, and (2) strong SHA-256-based cache-busting with server-side valida...", "justification": "code_not_present" } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b72e2a03-1c65-57be-b929-f64c50729de5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44577 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.26-tuxcare.3 is NOT affected by CVE-2026-44577. The vulnerability (unbounded memory accumulation when fetching local images) was fixed by upstream Vercel/Next.js in commit cd46de3bb14 (authored by steven@ceriously.com), which shipped in the upstream release before TuxCare maintenance began. The fix adds size tracking to MockedResponse.write() that accumulates chu...", "justification": "code_not_present" } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:297118ff-2a23-53df-aad6-29da6da4a00e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4e61e9b6-c55c-5f58-8670-eb423a287fca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44579 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:121cecf9-6bad-526f-b861-d2736060cff1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44580 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2026-44580 is not present in Next.js 15.5.26-tuxcare.3. The upstream vendor (Vercel) fixed this XSS vulnerability in their v15.5.26 release by adding HTML-escaping to beforeInteractive script serialization. TuxCare onboarded this already-fixed version, so the vulnerable pattern (unescaped JSON.stringify in inline scripts) does not exist in the target.", "justification": "code_not_present" } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:216d8a73-c849-5046-a348-4047143b5a2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44581 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-44581 (CSP nonce injection vulnerability). The fix was already present in the upstream v15.5.26 release that TuxCare onboarded. Commit 37ed48a65c9 by JJ Kasper (Vercel maintainer) introduced strict nonce validation using regex pattern /^'nonce-([A-Za-z0-9+/_-]+={0,2})'$/ and added htmlEscapeAttributeString() to escape nonces befor...", "justification": "code_not_present" } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b00df237-b11d-5918-8090-618411d7a9df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44582 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target repository (Next.js 15.5.26-tuxcare.3) is NOT affected by CVE-2026-44582. The vulnerability involved weak collision-prone hash (5-char hexHash) used for `_rsc` cache-busting parameters, allowing attackers to poison CDN caches by crafting requests with colliding hashes for different RSC response variants. The upstream Vercel fix (commit ecc15e012c2, authored by JJ Kasper on April 21, ...", "justification": "code_not_present" } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:0c644b30-fdb4-52c7-8ad0-2a60ac74a5c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45109 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:44efa17e-3f1b-53ad-8059-4a3b82225283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:eb0361b2-9bab-5307-913a-08a866a96f2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64642 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:7ca00f67-5eb6-562a-aa8a-80aad981e228", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64643 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26-tuxcare.3 is not affected by CVE-2026-64643. The vulnerability (Server Action ID enumeration via undefined-return behavior in the server module map proxy) was fixed by upstream Vercel in Next.js v15.5.26. The fix was already present in the upstream release when TuxCare onboarded it. The defense validates Server Action ID format (42-character length) before manifest lo...", "justification": "code_not_present" } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:fd506d42-677f-5958-975c-78099b11f66a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64644 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Target version 15.5.26-tuxcare.3 is NOT affected by CVE-2026-64644 (Next.js Image Optimization CPU exhaustion). The vulnerability fix was already present in the upstream Next.js release that TuxCare onboarded. The fix commit a098e54f224 by Vercel engineer Sebastian Silbermann (dated July 20, 2026) predates all TuxCare commits in the branch history, confirming the fix shipped with the upstream r...", "justification": "code_not_present" } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:11c10ba5-0145-52d0-ae93-a7c59df38b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64645 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:36c88eee-3d23-5cc4-a00d-1a7284d483db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64646 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target repository (Next.js 15.5.26-tuxcare.3) is NOT AFFECTED by CVE-2026-64646. The vulnerability\u2014excessive memory consumption through unbounded buffering of request bodies in Edge runtime Server Actions\u2014has been mitigated by upstream commit 744b8979f54 authored by sebastian.silbermann@vercel.com on 2026-07-20. This fix was already present in the upstream Next.js v15.5.26 release (2026-09-...", "justification": "code_not_present" } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e6e02ad2-fcfc-5538-a440-7afa23a1348e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64647 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.26-tuxcare.3 is NOT affected by CVE-2026-64647. The vulnerability (cache key collision causing response body leakage due to lossy UTF-8 decoding of binary request bodies) has been fixed by an upstream commit (77219435864) authored by sebastian.silbermann@vercel.com that was already present in the Next.js 15.x release before TuxCare began maintaining this version....", "justification": "code_not_present" } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8a2bfdf7-d999-5da7-9278-94ec93c840f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64648 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target is NOT AFFECTED by CVE-2026-64648. The vulnerability involves server-side fetch cache key collision when using `fetch(new Request(...), init)` with different init overrides, potentially leaking cached response bodies between requests with different request properties. The fix (merging init overrides into the Request object before cache key computation) is already present in the targe...", "justification": "code_not_present" } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6279d1ae-f5fe-5267-90ef-3b97f83d512d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64649 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:a6b2febb-66a0-5c5d-a874-1e162a0f17b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75604 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:5bb32e21-485e-5fb2-9bcf-f3c3772fd521", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94482 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 CVE-2026-94482 describes a CPU exhaustion vulnerability in Next.js Server Actions where crafted requests with excessive FormData fields could block request processing. The vulnerability was in the `areAllActionIdsValid` function which iterated over all FormData keys without limiting the number of `$ACTION_REF_` fields. An attacker could send a request with millions of small fields within the 1M...", "justification": "code_not_present" } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:7e425de7-b4ff-5a2d-9d5b-bd0cf561491e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94483 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:45f2d9c3-b7ed-55f6-95dc-62d09748fcb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94484 is fixed in version 15.5.26-tuxcare.3 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:57f96f1c-7d83-53bf-889b-404cdda9a0e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94485 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Next.js 15.5.26-tuxcare.3 is not affected by CVE-2026-94485. The vulnerable code pattern (excluding 'dynamicParams' from metadata route re-exports) was never present in the 15.5.x version line. The vulnerability was introduced in Next.js 16.x (commit ede8d1b861, Sept 2025) and fixed there in Sept-Oct 2026. The target's webpack metadata route loader correctly re-exports dynamicParams, allowing t...", "justification": "code_not_present" } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:62c5a6c5-52a3-5c10-84f5-e9227f3304fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94486 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target version 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-94486. The vulnerability exists in the Next.js development server's Model Context Protocol (MCP) endpoint at `/_next/mcp`, which was introduced in version 15.6.0-canary.24 (commit 58a60479550). The target is based on upstream v15.5.26, which predates the MCP feature. The MCP directory (`packages/next/src/server/mcp/`), MCP middlew...", "justification": "code_not_present" } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:db9bd34b-17c3-56f5-ac66-cc081bcff306", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94543 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Target version 15.5.26-tuxcare.1 is NOT affected by CVE-2026-94543. The vulnerability (cache entry replacement causing cross-route content serving in self-hosted Next.js SSG/ISR pages) was fixed by upstream commit aff987d546 which replaced the vulnerable single-entry cache with an LRU cache using compound keys. This upstream fix is already present in the target version.", "justification": "code_not_present" } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:86a0f0de-f01c-578a-ba3d-9e41d33ed042", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 Version 15.5.26-tuxcare.3 is NOT AFFECTED by CVE-2026-94544. The vulnerability requires the cross-request cache deduplication feature, which was introduced in Next.js v16.3.0 (commit 1066fbf7a4d, 2026-04-17). The target version 15.5.26 predates this feature and does not contain the vulnerable code path. Additionally, version 15.5.26 has existing Draft Mode protections: (1) Draft Mode content is...", "justification": "code_not_reachable" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8cdf7cd9-808d-5d95-8081-8d3a4d972385", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2464-fhr4-w9xw affects version 15.5.26-tuxcare.3 of next, and is fixed in 15.5.26-tuxcare.4." } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:027f9848-0d5d-5ae8-a781-419a28ef5755", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js 15.5.26-tuxcare.3 is not affected by GHSA-2xp9-vwfh-vxw4 (libheif RCE vulnerability). The vulnerable pattern was removed by an upstream fix that shipped in Next.js v15.5.26, which TuxCare onboarded. The fix implements a runtime libheif version check that blocks AVIF decoding when libheif < 1.23.2, preventing exploitation of the underlying vulnerability.", "justification": "code_not_present" } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:3326ffec-0306-5f96-bbdc-00b41b0212aa", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:442c5adc-86e5-561e-ab82-3701c3046171", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js version 15.5.26-tuxcare.3 is NOT affected by GHSA-5vj8-3v2h-h38v (Remote Code Execution via unsanitized path in require() calls). The vulnerability affected Next.js versions prior to 5.1.0 (February 2018). The fix was authored by upstream Next.js maintainer Tim Neutkens (tim@timneutkens.nl) in commit c8da345765e on 2018-02-13, which added path normalization validation to dete...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:5695cf05-3973-5df9-98ce-2644e1781075", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4bb4faa4-0a2d-56c5-af6c-5fec1c029a99", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:53e25b31-3508-5730-a1a9-08245de66de0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:f510483e-8e64-5299-891d-787ff3a1d209", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4eb535b7-3ef4-5902-b56f-e572ce89a566", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mwv6-3258-q52c affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:12605312-61b7-5db6-9f21-a07c7c90336b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 15.5.26-tuxcare.3 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:a3151fc1-94fa-5e3f-98b9-b919630b382e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target repository Next.js 15.5.26-tuxcare.3 is NOT AFFECTED by GHSA-vcvr-r3jv-pc5j (SVG injection RCE in next/og ImageResponse). The upstream vendor (Vercel) already fixed this vulnerability in version 15.5.26 before TuxCare onboarded the release. The fix commit b49b6ca47ed, authored by Josh Story (story@hey.com), added HTML escaping via the escape-html library to sanitize user-controlled s...", "justification": "code_not_present" } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ], "bom-ref": "urn:uuid:23b7a9bb-0362-5aa6-b50a-49310030735e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 does not affect version 15.5.26-tuxcare.3 of next. not_affected \u2014 The target Next.js v15.5.26-tuxcare.3 is not affected by GHSA-w37m-7fhw-fmv9 (CVE-2025-55183). All defensive measures from the upstream vendor patches are already present in HEAD. The vulnerability was fixed by upstream Vercel Next.js in commit e01e589e181 (\"Backport Next.js changes to v15.5.8\"), which shipped in v15.5.8 release before TuxCare onboarded this version. The fix includes: (1) actio...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/next@15.5.26-tuxcare.3" } ] }