Résumé
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
Détails de l’avis
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().
Références
- https://github.com/advisories/GHSA-f87g-xv8r-7p7x
- https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x
- https://nvd.nist.gov/vuln/detail/CVE-2026-94485
- https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
- https://github.com/vercel/next.js/releases/tag/v16.3.8
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-96234
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
- MEDIUMCVE-2026-107804
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
- CRITICALCVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
- HIGHCVE-2026-61435
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
- MEDIUMCVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
- HIGHCVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint