{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "vercel next.js: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/vercel--next-js/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/vercel--next-js/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed in Chainguard",
   "content_text": "Fixed versions: homepage 2.6.0-r2, jitsucom-jitsu-console 2.11.0-r41, keep-ui 0.54.3-r11, keep-ui-fips 0.54.3-r9, peerdb-ui 0.37.13-r1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed upstream (npm)",
   "content_text": "Fixed versions: next 15.5.28, next 16.4.1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed in Wolfi",
   "content_text": "Fixed versions: jitsucom-jitsu-console 2.11.0-r41.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94484/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94484/",
   "title": "CVE-2026-94484 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.",
   "date_published": "2026-10-02T15:26:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94484/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94484/",
   "title": "CVE-2026-94484 fixed in Chainguard",
   "content_text": "Fixed versions: keep-ui 0.54.3-r8, keep-ui-fips 0.54.3-r6, langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:26:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94484/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94484/",
   "title": "CVE-2026-94484 fixed upstream (npm)",
   "content_text": "Fixed versions: next 15.5.27, next 16.3.8.",
   "date_published": "2026-10-02T15:26:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94485/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94485/",
   "title": "CVE-2026-94485 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.",
   "date_published": "2026-10-02T15:23:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94485/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94485/",
   "title": "CVE-2026-94485 fixed in Chainguard",
   "content_text": "Fixed versions: langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:23:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94485/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94485/",
   "title": "CVE-2026-94485 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-02T15:23:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.",
   "date_published": "2026-10-02T15:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 fixed in Chainguard",
   "content_text": "Fixed versions: langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-02T15:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94543/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94543/",
   "title": "CVE-2026-94543 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.",
   "date_published": "2026-10-02T15:16:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94543/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94543/",
   "title": "CVE-2026-94543 fixed in Chainguard",
   "content_text": "Fixed versions: keep-ui 0.54.3-r8, keep-ui-fips 0.54.3-r6, langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:16:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94543/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94543/",
   "title": "CVE-2026-94543 fixed upstream (npm)",
   "content_text": "Fixed versions: next 15.5.27, next 16.3.8.",
   "date_published": "2026-10-02T15:16:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94544/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94544/",
   "title": "CVE-2026-94544 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.",
   "date_published": "2026-10-02T15:14:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94544/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94544/",
   "title": "CVE-2026-94544 fixed in Chainguard",
   "content_text": "Fixed versions: langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:14:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94544/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94544/",
   "title": "CVE-2026-94544 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-02T15:14:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94486/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94486/",
   "title": "CVE-2026-94486 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.",
   "date_published": "2026-10-02T15:12:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94486/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94486/",
   "title": "CVE-2026-94486 fixed in Chainguard",
   "content_text": "Fixed versions: langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:12:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94486/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94486/",
   "title": "CVE-2026-94486 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-02T15:12:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103004/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103004/",
   "title": "CVE-2026-103004 disclosed",
   "content_text": "Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.\n\nWhat values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.\n\nThis has been patched in 16.3.8.",
   "date_published": "2026-10-01T14:50:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103004/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103004/",
   "title": "CVE-2026-103004 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-01T14:50:27Z"
  }
 ]
}