next 15.5.28

Direct Vulnerabilities

Known vulnerabilities in the next package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Use of Cache Containing Sensitive Information next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's cache key generation logic, where cache keys are not bound to their source route. An attacker can trigger a cache key collision between distinct routes, causing one route's cached response to be served for a different route and resulting in partial availability loss for affected endpoints. How to fix Use of Cache Containing Sensitive Information? Upgrade `next` to version 15.5.27, 16.3.8, 16.3.8 or higher.	>=15.0.0 <15.5.27>=16.0.0 <16.3.8<16.3.8
M Use of Cache Containing Sensitive Information next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the `use-cache-wrapper.ts` `cache` function, where draft mode state is not accounted for when sharing cached fills across concurrent requests. A draft mode request can join a pending public cache fill and receive published content instead of draft content, or conversely, a fill executed under draft mode containing unpublished content can be registered and served to non-draft requests. Note: This is only exploitable when the `'use cache'` directive is in use and concurrent requests occur, one of which has draft mode enabled. How to fix Use of Cache Containing Sensitive Information? Upgrade `next` to version 16.3.8 or higher.	<16.3.8
M Allocation of Resources Without Limits or Throttling next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of an upper bound on the disk cache used by the image optimization. An attacker can exhaust disk storage by generating a large number of unique image optimization variants, leading to service disruption. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `next` to version 16.1.7, 16.2.0-canary.54 or higher.	>=10.0.0 <16.1.7>=16.2.0-canary.0 <16.2.0-canary.54
H Allocation of Resources Without Limits or Throttling next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Partial Prerendering resume endpoint when unauthenticated POST requests with the `Next-Resume: 1` header are processed and attacker-controlled postponed state data is handled. An attacker can cause the server process to crash and exhaust system memory by sending large or highly compressed payloads that are buffered or decompressed without size limits. Note: This is only exploitable if the application is running with `experimental.ppr: true` or `cacheComponents: true` configured along with the `NEXT_PRIVATE_MINIMAL_MODE=1` environment variable. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `next` to version 15.6.0-canary.61, 16.1.1-canary.16, 16.1.5 or higher.	>=15.0.0-canary.0 <15.6.0-canary.61>=16.0.0-beta.0 <16.1.1-canary.16>=16.1.1 <16.1.5

Vulnerability

Vulnerable Version

Use of Cache Containing Sensitive Information

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's cache key generation logic, where cache keys are not bound to their source route. An attacker can trigger a cache key collision between distinct routes, causing one route's cached response to be served for a different route and resulting in partial availability loss for affected endpoints.

How to fix Use of Cache Containing Sensitive Information?

Upgrade next to version 15.5.27, 16.3.8, 16.3.8 or higher.

>=15.0.0 <15.5.27>=16.0.0 <16.3.8<16.3.8

Use of Cache Containing Sensitive Information

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the use-cache-wrapper.ts cache function, where draft mode state is not accounted for when sharing cached fills across concurrent requests. A draft mode request can join a pending public cache fill and receive published content instead of draft content, or conversely, a fill executed under draft mode containing unpublished content can be registered and served to non-draft requests.

Note: This is only exploitable when the 'use cache' directive is in use and concurrent requests occur, one of which has draft mode enabled.

How to fix Use of Cache Containing Sensitive Information?

Upgrade next to version 16.3.8 or higher.

<16.3.8

Allocation of Resources Without Limits or Throttling

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of an upper bound on the disk cache used by the image optimization. An attacker can exhaust disk storage by generating a large number of unique image optimization variants, leading to service disruption.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade next to version 16.1.7, 16.2.0-canary.54 or higher.

>=10.0.0 <16.1.7>=16.2.0-canary.0 <16.2.0-canary.54

Allocation of Resources Without Limits or Throttling

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Partial Prerendering resume endpoint when unauthenticated POST requests with the Next-Resume: 1 header are processed and attacker-controlled postponed state data is handled. An attacker can cause the server process to crash and exhaust system memory by sending large or highly compressed payloads that are buffered or decompressed without size limits.

Note:

This is only exploitable if the application is running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade next to version 15.6.0-canary.61, 16.1.1-canary.16, 16.1.5 or higher.

>=15.0.0-canary.0 <15.6.0-canary.61>=16.0.0-beta.0 <16.1.1-canary.16>=16.1.1 <16.1.5

next@15.5.28

The React Framework

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically