Source summary

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version fo sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected

next >=10.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-2464-fhr4-w9xw

Source summary

Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack Patches Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1. If you are using any of the above packages ple

Affected

react-server-dom-parcel 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-turbopack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-webpack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0

Fixed in

19.0.9

ID

GHSA-xqc2-xf4c-x3h3

Source summary

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import { ImageResponse } from 'next/og' export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? '' return new ImageResponse( {value} ) } Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attribu

Affected

next >=16.2.0 <16.3.6

Fixed in

16.3.6

ID

GHSA-vcvr-r3jv-pc5j

• Project runs @modelcontextprotocol/server-everything at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
• The server is started with the SSE or StreamableHTTP transport, not the default stdio transport.
• The server process environment contains secrets such as API keys, database credentials or tokens.
• A browser on the same machine or network visits an attacker-controlled web page while the server is running.

Affected

@modelcontextprotocol/server-everything >=2025.9.24 <=2026.8.31 · @modelcontextprotocol/server-everything >=1.0.0 <2.0.1

Fixed in

2.0.1

ID

GHSA-mvf5-2qqv-rg3c

• Project runs @modelcontextprotocol/server-filesystem on a vulnerable version (e.g. 2026.1.14 or another date-versioned release; fixed in 2.0.1).
• The server is configured with an allowed directory.
• A symlink exists inside the allowed directory pointing to a file outside the allowed directory.
• An attacker can influence the list_directory_with_sizes tool call, directly or via prompt injection or repository content read by an agent.

Affected

@modelcontextprotocol/server-filesystem >=2025.7.1 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1

Fixed in

2.0.1

ID

GHSA-hhwq-wxfx-cj7g

• Project uses @modelcontextprotocol/server-filesystem (versions including the 2025.7.1 fixes, where validatePath returns the un-canonicalised path on the ENOENT fallback).
• The server exposes write_file, edit_file, create_directory, or move_file tool calls that create a not-yet-existing path inside an allowed directory.
• A separate local process running as the same user can replace a parent directory inside allowedDirectories with a symlink pointing outside the allowed tree during the race window.

Affected

@modelcontextprotocol/server-filesystem >=2025.1.14 <=2026.8.31 · @modelcontextprotocol/server-filesystem <2.0.1

Fixed in

2.0.1

ID

GHSA-53mr-w429-c597

• Project runs the @modelcontextprotocol/server-filesystem MCP server at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
• Server is configured with allowed directories intended to sandbox filesystem tool access.
• An attacker can influence the path arguments of the server's filesystem tools (e.g. via prompt injection in content the LLM reads).
• A sibling path exists (or can be created via the write tools) named like an allowed directory plus a trailing quote or whitespace character.

Affected

@modelcontextprotocol/server-filesystem >=2025.8.21 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1

Fixed in

2.0.1

ID

GHSA-7rgq-gccq-qphx