{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:98a32f48-7b2e-53c3-a4ce-1a80ac3b7316", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "next", "purl": "pkg:npm/next@16.0.6-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/next@16.0.6-tuxcare.13", "version": "16.0.6-tuxcare.13", "pedigree": { "ancestors": [ { "name": "next", "purl": "pkg:npm/next@16.0.6", "type": "library", "version": "16.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "@base-ui-components__react@1.0.0-beta.1", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4be895b0-dcc8-5b2b-89b8-2da7e45f020e", "analysis": { "state": "resolved", "detail": "Vulnerability @base-ui-components__react@1.0.0-beta.1 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2017-16877", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:7c90814f-b68a-52cc-9a9b-1cddaf590bc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-16877 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2017-16877 (directory traversal in /_next and /static paths) was fixed in Next.js v2.4.1 (June 2017) by upstream developer Arunoda Susiripala. The fix added path validation to ensure static file requests cannot traverse outside intended directories. The target version (16.0.6) is from 2024-2025, long after the fix. The fix commit (43c447edd0c) is an ancestor of the v16.0.6 tag that TuxCare ...", "justification": "code_not_present" } }, { "id": "CVE-2018-18282", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:84471f23-b4df-58ab-973a-56693601b372", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-18282 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2018-18282 describes an XSS vulnerability in Next.js 7.0.0 and 7.0.1 via the 404 or 500 /_error page, where malicious JavaScript embedded in the URL could be executed when the error page was displayed. The target version 16.0.6 is 9 major versions later and does not contain the vulnerable code pattern. The current implementation uses React JSX rendering which automatically escapes all user-...", "justification": "code_not_present" } }, { "id": "CVE-2018-6184", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:2748bee5-c457-5df0-bda6-9a9d2249e2b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-6184 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2020-15242", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:439bb6e9-b66c-5401-841e-ca091de1eb98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15242 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2020-15242 affected Next.js versions 9.5.0-9.5.3 due to a security vulnerability in the bundled node-fetch dependency version 2.6.0. The vulnerability was fixed in Next.js v9.5.4 by upgrading node-fetch to 2.6.1. The target version (16.0.6-tuxcare.13) ships with node-fetch 2.6.7, which includes all security fixes from 2.6.1 onwards. The vulnerable dependency code (node-fetch 2.6.0) is not p...", "justification": "code_not_present" } }, { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4a4662fc-63db-5917-aa4e-0cc2a44f4cf4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5284 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2020-5284 is a path traversal vulnerability in Next.js below version 9.3.2, allowing attackers to read arbitrary files outside the intended static/public directories via URL-encoded path traversal sequences (e.g., `/_next/static/../BUILD_ID`). The target repository (Next.js 16.0.6-tuxcare.13) is NOT AFFECTED because the upstream fix (commit 1d6ffc39f7b) was already present in the upstream r...", "justification": "code_not_present" } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:7c957882-2752-5221-bd32-35401068364a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37699 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2021-37699 affects Next.js versions 10.0.5-10.2.0 and 11.0.0-11.0.1, allowing open redirects via specially encoded paths with repeated slashes (e.g., //google.com) when pages/_error.js is statically generated. The target version (Next.js 16.0.6-tuxcare.13) is NOT affected because the upstream fix (commit 4ab41efdbfd, August 2021) was already present in the Next.js v16.0.6 release that TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2021-39178", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:5455abec-a209-5fac-9cb6-c63aa9c2e269", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-39178 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1ce25c18-2a70-50b6-b535-8c963d3e412d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43803 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2022-21721", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:60ae6cc7-190e-5784-8f0e-450ff77cdcc1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-21721 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2022-21721 affects Next.js versions >= 12.0.0 using i18n functionality, where requests to `/${locale}/_next/` paths could trigger a denial of service. The vulnerability was fixed in upstream Next.js 12.0.9 (commit 69524c290d8, January 2022) by adding an `internalRender` parameter to prevent infinite recursion loops. The target repository is at version 16.0.6-tuxcare.13, which includes this ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23646", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:a406b428-a28b-5273-ae66-aa2e21153048", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23646 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2022-23646 affects Next.js 10.0.0-12.0.10, allowing malicious user-provided SVG images to execute scripts or misrepresent UI. The target (Next.js 16.0.6-tuxcare.13) contains the upstream fix from commit 8a55612c0d (Feb 2022) that blocks SVG images by default unless `dangerouslyAllowSVG` config is explicitly enabled. The fix adds: (1) SVG blocking check at image-optimizer.ts:1328-1341, (2) s...", "justification": "code_not_present" } }, { "id": "CVE-2022-36046", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:3af133be-7c0d-5943-940d-4d5e67e5922e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-36046 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2022-36046 affects only Next.js v12.2.3 and was fixed in v12.2.4 by upstream Vercel. The target version 16.0.6-tuxcare.13 is 4+ major versions ahead and contains the upstream fix (commit f1aac90c7ba) that adds proper error handling to prevent unhandled promise rejections in body-streams.ts. The vulnerable code pattern is not present - it was fixed by the upstream vendor before TuxCare's inv...", "justification": "code_not_present" } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:076c3a4e-6c0f-514c-8b3f-42130cc311dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46298 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-34350", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:a68b6d30-76fc-50ca-b252-1bd88095eb2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34350 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-34351", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:60ae6e73-7847-58cb-894a-075fb0a9dea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34351 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-39693", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:a874657d-11e6-546f-9a5d-4caa3f542489", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39693 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-46982", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:39163f43-041d-5a16-8035-3d001c48e237", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-46982 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-47831", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:40f658bf-c5ad-58da-8148-070b7e921a4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47831 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-51479", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:bc8619a0-e66b-5398-af0f-3280f6dadeba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51479 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2024-56332", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4d65b923-39ee-57e8-8094-44501c40f2cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56332 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-29927", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:d70057aa-e2c5-5037-a619-df6996ee40ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-29927 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-30218", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:19e94219-1489-5e62-b4f8-d40b92ccf2f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-30218 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:de1bd7a5-6889-55f5-bc2d-783646f7fb68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32421 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2025-32421 describes a vulnerability where attackers can inject internal middleware headers (x-middleware-rewrite, x-middleware-redirect, x-middleware-set-cookie, x-now-route-matches, etc.) in HTTP requests to manipulate Next.js routing and cause incorrect response data to be served (e.g., JSON pageProps instead of HTML). The target Next.js 16.0.6-tuxcare.13 is NOT AFFECTED because the comp...", "justification": "code_not_present" } }, { "id": "CVE-2025-48068", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:640fc7fa-9a42-5613-9d7a-2df6f664fb43", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48068 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2025-48068 is not affecting this Next.js 16.0.6 installation. The cross-origin request blocking mechanism (`blockCrossSiteDEV`) that prevents source code exposure from the development server is already present in the codebase, introduced by upstream commit d928709b749 (authored by JJ Kasper, March 2025). This commit predates the first TuxCare commit in the branch history (dd5f507d), confirm...", "justification": "requires_configuration" } }, { "id": "CVE-2025-49005", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:48f8951e-8905-556c-b90d-686a93710acb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49005 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-49826", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:bcc17e2b-3b95-50a1-8425-75b3db774441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49826 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:8573fc0d-2444-5475-b4ff-cff4cdaf8b0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55173 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 Target version 16.0.6-tuxcare.13 is NOT affected by CVE-2025-55173. Both fixes addressing the vulnerability (header forwarding removal and enhanced content-type validation with PDF rejection) were already present in the upstream Next.js v16.0.6 release before TuxCare onboarded this version. The vulnerable code pattern does not exist in the target.", "justification": "code_not_present" } }, { "id": "CVE-2025-55182", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:ffa8f1cb-0cbe-59af-ae64-d957606065d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55182 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:22003941-9342-5d17-9560-19c0f81d6ccc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-57752 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 CVE-2025-57752 is not present in Next.js 16.0.6-tuxcare.13. The vulnerability involved forwarding request headers (Cookie, Authorization) when fetching internal images through the image optimizer, allowing user-specific images to be incorrectly cached and served to unauthorized users. The upstream fix (commit 6b12c60c61ee80cb0443ccd20de82ca9b4422ddd by Steven from Vercel) removed the `headers: ...", "justification": "code_not_present" } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:78e6d089-0b85-511a-b401-3531c4eb5aba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57822 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-59471", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:da103a7f-cd00-58da-add7-a9355ff519fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59471 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2025-59472", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:61a529fb-e678-538e-a681-44c90130bf42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59472 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-103004", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:795802c8-081c-5609-80b1-843ea8afc73d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103004 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 Version 16.0.6-tuxcare.13 is NOT AFFECTED by CVE-2026-103004. The vulnerability requires `'use cache'` functions to read root parameters (e.g., `lang()`, `countryCode()`), but this version explicitly disallows root parameter access inside regular cache scopes, throwing an error immediately (root-params.ts:61-64). The feature enabling root params in cache functions was added in commit 8283b1260b...", "justification": "code_not_present" } }, { "id": "CVE-2026-27977", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:0fabf547-e8a4-5cf0-960d-381e01bca4e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27977 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-27978", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:061524a7-e755-561d-8d45-1ec26902f0e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27978 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-27979", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:6dddc75f-3e97-5f90-956a-44de6253011f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27979 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-27980", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:7cae46b5-c519-57a8-ba35-e2af0d0e61b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27980 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-29057", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:e4631f76-129e-56b2-a655-eafdb5abc3b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29057 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44572", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:d7bd5779-7ac1-5760-bf3a-bff22402ce83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44572 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44573", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:02659bd2-7e34-5ca8-8232-66f38f40ad1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44573 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44574", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:6b7373d7-b503-5cbc-9702-9a6ee6949eb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44574 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44575", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:eaea6c6f-0608-58cd-9a4b-6c0268cfc0ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44575 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44576", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1cc10e3c-de94-5adb-917f-03af37103aa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44576 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44577", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:74086758-3040-5886-b202-27a73c5824e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44577 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44578", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4335436b-e2b9-507f-8f5b-8bfd0d8b6356", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44578 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44579", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:ee493bc9-7f0f-5d89-9001-b96aab713481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44579 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44580", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:641d89a3-d349-501d-ac20-87e2e67ee135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44580 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44581", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:bc2e0193-3ec0-5e41-835f-9d5f0bc98459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44581 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-44582", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:8f9d9c21-8e5e-5ae4-9819-30d7f1817729", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44582 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-45109", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:524a91a6-e86f-5d55-a9b1-9b97107d2a0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45109 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64641", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:b030b7b3-7538-53d3-a364-ea3134846d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64641 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64642", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:d134bfc6-41b3-5914-a9a9-27035a51bc41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64642 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64643", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:cd3a0306-3f63-55f1-800c-b2825fcb807b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64643 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64644", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:ed6db6ad-81b7-5050-9aee-e407256843b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64644 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64645", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1e199dfa-f213-5ff1-b8dd-37083aeae800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64645 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64646", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1cf4f08d-93ab-5f00-a474-f83d23d66292", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64646 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64647", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4e957783-87ac-5f23-941d-16c52f50df00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64647 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64648", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4aad2617-d683-5ec1-a8a3-6cd6311a77dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64648 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-64649", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1aa94c0c-7a38-5eea-b405-f372ce7692b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-64649 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-75604", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:90d9f235-5104-5c92-acb3-63518c85b8bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75604 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94482", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:b6672473-7033-522f-abd4-d439fa557374", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94482 affects version 16.0.6-tuxcare.13 of next, and is fixed in 16.0.6-tuxcare.14." } }, { "id": "CVE-2026-94483", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:f8ab73f8-1a6f-5d9e-b676-3ec7149efb3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94483 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94484", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:2b3f5590-3c1b-51d1-8099-12262f9e9105", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94484 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94485", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1a354eb4-32d6-50b6-8276-e058f8a47b63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94485 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94486", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:4a45b230-6f20-561f-81fe-550b7e86c24b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94486 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94543", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:9dbc89e3-5d80-5144-b65b-dbeb26705ec7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-94543 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "CVE-2026-94544", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:bf3199ff-6ddb-5386-b807-8751e077f38f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-94544 does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 Version 16.0.6 lacks the cross-request deduplication feature that causes the vulnerability described in CVE-2026-94544. The patch modifies `skipCrossRequestDedupe` logic around line 2900+ in use-cache-wrapper.ts, but this variable and associated pending-fill sharing mechanism do not exist in the target's 1832-line version. Searches for \"dedupe\", \"dedup\", \"skipCrossRequestDedupe\", and cross-requ...", "justification": "code_not_reachable" } }, { "id": "GHSA-2464-fhr4-w9xw", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:ef2da4fc-0286-5594-b69c-77c9cacdc995", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2464-fhr4-w9xw affects version 16.0.6-tuxcare.13 of next, and is fixed in 16.0.6-tuxcare.14." } }, { "id": "GHSA-2xp9-vwfh-vxw4", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:936171f3-f418-53f3-b400-23d99de99e6a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2xp9-vwfh-vxw4 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-5j59-xgg2-r9c4", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:84c5cc0a-3458-543a-8d7b-2d38cf968c3f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5j59-xgg2-r9c4 affects version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-5vj8-3v2h-h38v", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:b14590ee-85f7-52a0-b17f-30c71c0e57ae", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vj8-3v2h-h38v does not affect version 16.0.6-tuxcare.13 of next. not_affected \u2014 The target Next.js 16.0.6-tuxcare.13 is NOT AFFECTED by GHSA-5vj8-3v2h-h38v (Remote Code Execution via path traversal in page requiring). The vulnerability was fixed upstream in Next.js 5.1.0 (February 2018, commit c8da345765e) and this fix shipped in the upstream release that TuxCare onboarded. The current codebase contains the same path normalization defense that detects and rejects traversal...", "justification": "code_not_present" } }, { "id": "GHSA-673q-mjm6-r5xr", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:2ccf91ee-a017-5637-bc49-d0d15be95cb4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-673q-mjm6-r5xr affects version 16.0.6-tuxcare.13 of next, and is fixed in 16.0.6-tuxcare.14." } }, { "id": "GHSA-8h8q-6873-q5fj", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:c41d1669-947b-5094-a020-bbcdcf0ebe53", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8h8q-6873-q5fj is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-9qr9-h5gf-34mp", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:50a4bfc4-ac85-54f6-aff8-fba99aa73422", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-9qr9-h5gf-34mp is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-h25m-26qc-wcjf", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:23d8826f-2779-5bad-bcc8-93f5cd566d26", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h25m-26qc-wcjf is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-mwv6-3258-q52c", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:a8b69804-e697-54ff-99a0-5359ee64aa2e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-mwv6-3258-q52c does not affect version 16.0.6-tuxcare.13 of next. Target version 16.0.6 is NOT AFFECTED. The target uses React version 52684925-20251110 (November 10, 2025), which predates the introduction of the vulnerable code by one month. The vulnerability (unbounded for loop in ReactPromise.prototype.then causing infinite CPU consumption during thenable chain inspection) was introduced in commit 4e20596af8 with React c689797a-20251209 (December 10, 2025) and fixed in commit 9a0dc9c555 with React 419bf4ac-20251211 (December 11, 2025). The target's React implementation does not contain the vulnerable code pattern, so the attack path from malicious serialized data to server hang does not exist.", "justification": "code_not_present" } }, { "id": "GHSA-q4gf-8mx6-v5v3", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:3401c6e4-cf2b-5a2e-8bec-dc8040eb1c44", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "GHSA-vcvr-r3jv-pc5j", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:937574fd-f5e3-5961-9352-8ae24b3c3e6f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vcvr-r3jv-pc5j affects version 16.0.6-tuxcare.13 of next, and is fixed in 16.0.6-tuxcare.14." } }, { "id": "GHSA-w37m-7fhw-fmv9", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:9a80affb-2e69-5581-94a4-36dd4603dc82", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-w37m-7fhw-fmv9 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "stacktrace-parser@0.1.10", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:07594e46-c1af-59b2-a7cc-27244080cb87", "analysis": { "state": "resolved", "detail": "Vulnerability stacktrace-parser@0.1.10 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "taskr@1.1.0", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:20f0ad66-d0ab-5854-ac34-4fded3c46b06", "analysis": { "state": "resolved", "detail": "Vulnerability taskr@1.1.0 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "@types__node@20.17.6", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:1e04dd97-0bdd-58c7-80e9-bcf9b333f8d7", "analysis": { "state": "resolved", "detail": "Vulnerability @types__node@20.17.6 is fixed in version 16.0.6-tuxcare.13 of next." } }, { "id": "webpack-sources@3.2.3", "affects": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ], "bom-ref": "urn:uuid:d7e9b0f7-b41f-5e84-ac99-933a81c0e104", "analysis": { "state": "resolved", "detail": "Vulnerability webpack-sources@3.2.3 is fixed in version 16.0.6-tuxcare.13 of next." } } ], "dependencies": [ { "ref": "pkg:npm/next@16.0.6-tuxcare.13" } ] }