{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "vercel next.js: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/vercel--next-js/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/vercel--next-js/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed in Chainguard",
   "content_text": "Fixed versions: homepage 2.6.0-r2, jitsucom-jitsu-console 2.11.0-r41, keep-ui 0.54.3-r11, keep-ui-fips 0.54.3-r9, peerdb-ui 0.37.13-r1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed upstream (npm)",
   "content_text": "Fixed versions: next 15.5.28, next 16.4.1.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94482/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94482/",
   "title": "CVE-2026-94482 fixed in Wolfi",
   "content_text": "Fixed versions: jitsucom-jitsu-console 2.11.0-r41.",
   "date_published": "2026-10-22T15:22:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 disclosed",
   "content_text": "Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.",
   "date_published": "2026-10-02T15:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 fixed in Chainguard",
   "content_text": "Fixed versions: langfuse-fips-4 4.49.0-r7, langfuse-fips-4-worker 4.49.0-r7, zitadel-4-login 4.19.4-r3.",
   "date_published": "2026-10-02T15:18:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94483/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94483/",
   "title": "CVE-2026-94483 fixed upstream (npm)",
   "content_text": "Fixed versions: next 16.3.8.",
   "date_published": "2026-10-02T15:18:38Z"
  }
 ]
}