Source summary

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version of sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected

next >=10.0.0 <=15.5.27 · next >16.0.0 <=16.4.0 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-2464-fhr4-w9xw

Source summary

Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack Patches Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1. If you are using any of the above packages ple

Affected

react-server-dom-parcel 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-turbopack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-webpack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0

Fixed in

19.0.9

ID

GHSA-xqc2-xf4c-x3h3

Source summary

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import { ImageResponse } from 'next/og' export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? '' return new ImageResponse( {value} ) } Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attribu

Affected

next >=16.2.0 <16.3.6

Fixed in

16.3.6

ID

GHSA-vcvr-r3jv-pc5j

• Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
• The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
• The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.

Affected

bun >=1.0.21 <1.4.4

Fixed in

1.4.4

ID

GHSA-663w-cv8g-jj2p

• Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
• Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
• No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
• An attacker is positioned in the network path between the Bun process and the server.

Affected

bun <1.4.4

Fixed in

1.4.4

ID

GHSA-26q8-h657-pf84

• Project uses multer below version 2.5.0.
• multer is configured with an asynchronous fileFilter.
• The multer upload endpoint accepts requests from untrusted (including unauthenticated) clients.

Affected

multer >=2.0.0 <2.5.0

Fixed in

2.5.0

ID

GHSA-q7qp-rjg7-q26m

• Project uses MCP Inspector v2 (@modelcontextprotocol/inspector) at version 2.7.0 or earlier.
• The Inspector Node backend's POST /api/fetch proxy route is in use for MCP traffic or OAuth work.
• Inspector connects to (or is redirected during OAuth/CIMD to) an untrusted or misbehaving server that can return a very large or unbounded response body.

Affected

@modelcontextprotocol/inspector >=2.0.0 <=2.11.0 · @modelcontextprotocol/inspector >=0.21.2 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.21.2 <=1.0.2

Fixed in

2.12.0 · 1.0.3

ID

GHSA-m5pj-3536-3xcp