https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for vercel/next.js en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/600 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/600 Tue, 25 Aug 2026 16:55:00 GMT Before the patch, the file-system incremental cache built file paths by directly joining the request pathname with the cache root directory, without validating the result. On Windows, encoded backslashes (`%5C`) in dynamic segments decoded to path separators, allowing `..%5C..%5C` sequences to traverse outside the cache directory (e.g., from `server/pages` to `.next/server-reference-manifest.json`). An attacker could request a crafted data URL and read arbitrary JSON files from the server, including the server actions encryption key. The patch adds a check that the resolved path remains within the cache root and escapes backslashes in route delimiters. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/355 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/355 Sat, 25 Jul 2026 06:45:13 GMT When a client disconnects mid-response, the vendored compression middleware's zlib stream was never released because its cleanup only ran inside its own res.end() wrapper, which never executes on abrupt disconnects. Each aborted compressed response permanently pinned ~256 KiB of native zlib memory that survives garbage collection, allowing an attacker (or even normal bot/CDN traffic) to repeatedly open and abort requests, causing unbounded RSS growth until the server is OOM-killed. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/344 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/344 Tue, 21 Jul 2026 17:08:04 GMT The action ID validation logic for MPA (non-JS) form submissions iterated over all form data keys and, for any key starting with $ACTION_REF_, performed expensive decoding/validation work with no limit on the number of such keys. An attacker could submit a form with an enormous number of $ACTION_REF_ fields to force the server to perform excessive processing per request, exhausting CPU/memory and causing a denial of service. The patch caps processing to at most 2 $ACTION_REF_ fields (the expected maximum for legitimate forms) and short-circuits validation once that limit is exceeded. Patch landed 1 day 6 hours 12 minutes before CVE-2026-64641 was published. medium confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/345 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/345 Tue, 21 Jul 2026 17:08:17 GMT In the Edge runtime, Server Actions did not enforce the `serverActions.bodySizeLimit` configuration when reading request bodies (both multipart and non-multipart). The `// TODO: add body limit` comment confirms the limit check was never implemented for Edge, allowing attackers to send arbitrarily large request bodies to Server Actions running on Edge runtime, potentially exhausting memory/CPU resources despite the developer having configured a body size limit. Patch landed 1 day 6 hours 15 minutes before CVE-2026-64646 was published. medium confirmed CVE-2026-64646 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/346 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/346 Tue, 21 Jul 2026 17:10:02 GMT The previous detectContentType() implementation scanned the entire uploaded/upstream image buffer (including running a full sharp metadata parse and regex-based SVG detection over the whole buffer) to determine the image format, which allowed an attacker to submit a large or crafted file (e.g. large whitespace-padded pseudo-SVG or crafted image data) that would block the Node.js event loop for a long time during synchronous/CPU-heavy processing. This could be used to cause a denial of service against the image optimization endpoint. The patch limits the SVG detection to a bounded scan, removes the fallback to full sharp metadata parsing on the whole buffer, and only inspects the first 1024 bytes via the lightweight detector, greatly reducing worst-case CPU/blocking time. Patch landed 1 day 6 hours 15 minutes before CVE-2026-64644 was published. medium confirmed CVE-2026-64644 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/272 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/272 Wed, 17 Jun 2026 16:03:34 GMT A non-RSC HTML request with the `Next-Router-Prefetch: 1` header set could cause the server to enter the partial prefetch tree path, produce a null active cache node, and suspend the HTML render indefinitely until a timeout occurred. This could be triggered by any external client sending crafted HTTP headers to a Next.js App Router application, effectively causing a denial of service by hanging render threads. The fix ensures prefetch routing headers are only respected when the request is also a valid RSC request. Patch landed 35 days 7 hours 18 minutes before CVE-2026-64641 was published. medium confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/262 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/262 Fri, 12 Jun 2026 21:50:44 GMT In Next.js edge runtime, the `setTimeout` and `setInterval` polyfills incorrectly used `globalThis` (the Node.js global object) instead of the sandboxed edge runtime context object when invoking callbacks via `.apply()`. This allowed malicious code running in the edge sandbox to access Node.js globals like `process.mainModule.require()` and escape the sandbox entirely, gaining access to the Node.js runtime including filesystem operations, arbitrary module loading, and other restricted APIs. Patch landed 40 days 1 hour 30 minutes before CVE-2026-64641 was published. critical confirmed CVE-2026-64641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/81 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/81 Tue, 17 Mar 2026 23:13:17 GMT Before this patch, Next.js development servers only warned (but did not block) cross-origin requests to internal dev assets and endpoints (/_next/*, /__nextjs*) when `allowedDevOrigins` was not configured. An attacker could craft a malicious webpage that loads or interacts with internal dev-only resources (HMR WebSocket, error feedback endpoints, internal chunks) from any origin. The patch changes the default behavior from warn-only to blocking with a 403 response, preventing unauthorized cross-origin access to dev server internals. medium confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/76 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/76 Tue, 17 Mar 2026 02:21:01 GMT Before the patch, when the `Origin` header was set to the string `'null'` (which browsers send from privacy-sensitive contexts like sandboxed iframes), Next.js would skip the CSRF origin check entirely because the code treated `'null'` as a missing/invalid origin and fell through without validation. This allowed an attacker to embed a sandboxed iframe that submits a Server Action cross-origin with user credentials (cookies) attached, bypassing CSRF protection. The patch now treats `'null'` as a valid but opaque origin and checks it against the `allowedOrigins` allowlist, blocking unauthorized cross-origin Server Action submissions from sandboxed contexts. Patch landed 13 hours 32 minutes before CVE-2026-27978 was published. high confirmed CVE-2026-27978 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/77 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/77 Tue, 17 Mar 2026 02:21:23 GMT The commit patches the compiled `http-proxy` / `follow-redirects` library bundled in Next.js, referencing security advisory GHSA-ggv3-7p47-pfv8. The vulnerability involves improper handling of HTTP redirects in the `follow-redirects` library, which could allow an attacker to manipulate redirect targets to leak sensitive request headers (such as Authorization) to unintended hosts or bypass security controls via crafted redirect responses. The patch updates the compiled bundle with fixes to the redirect handling logic. Patch landed 14 hours 35 minutes before CVE-2026-29057 was published. high confirmed CVE-2026-29057 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/75 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/75 Tue, 17 Mar 2026 00:49:23 GMT Before the patch, WebSocket connections to Next.js dev server endpoints (e.g., /_next/webpack-hmr) were accepted from privacy-sensitive origins (e.g., pages served with 'sandbox' CSP that sets origin to null). The old code only blocked requests when rawOrigin was truthy AND not equal to 'null', meaning requests with origin header 'null' (sent by sandboxed iframes/pages) bypassed origin validation entirely. The patch fixes this by treating a 'null' origin as a defined but non-allowed origin, causing such requests to be blocked. Patch landed 14 hours 47 minutes before CVE-2026-27977 was published. high confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/57 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/57 Thu, 26 Feb 2026 14:22:19 GMT Before the patch, `ProcessEnv::read_all()` returned a serializable `EnvMap`, which could be automatically persisted into Turbopack/Next.js' on-disk persistent cache. This meant any process environment variable (including secrets like API keys and tokens) could be written to disk and later recovered by anyone with read access to the cache directory (e.g., another local user, CI artifact consumers, or a compromised build agent). The patch introduces `TransientEnvMap` with `serialization = "none"` and changes `read_all()` to return it, preventing env vars from being persisted and forcing them to be re-read from the process environment after cache restore. Patch landed 19 days 1 hour 18 minutes before CVE-2026-27977 was published. high confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/42 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/42 Fri, 20 Feb 2026 04:55:06 GMT The unhandled rejection filter module was being bundled twice, causing mutual recursion when handling unhandled Promise rejections. Each instance captured the other's handler, creating an infinite loop that would overflow the stack and crash the server on any unhandled rejection. Patch landed 25 days 10 hours 41 minutes before CVE-2026-27977 was published. medium confirmed CVE-2026-27977 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/32 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/32 Wed, 18 Feb 2026 17:06:36 GMT The code had a missing size check for postponed request bodies in self-hosted setups, allowing attackers to send arbitrarily large payloads that would consume server memory and potentially crash the application. The patch ensures maxPostponedStateSize is consistently enforced across all code paths that buffer postponed bodies. Patch landed 26 days 23 hours 23 minutes before CVE-2026-27979 was published. medium confirmed CVE-2026-27979