Am I affected?
Recent high and critical vulnerabilities in common SaaS packages, from the GitHub Advisory Database.
- next
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrayscritical - next
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usedcritical - next
Next.js: Denial of Service in App Router using Server Actionshigh - next
Next.js has Server-Side Request Forgery in Image Optimizationhigh - axios
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionhigh - axios
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFhigh - axios
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)high - axios
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationhigh - axios
Axios: Prototype Pollution Gadget in axios toFormData Optionshigh - axios
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlshigh - axios
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationhigh - next
Next.js: Remote Code Execution in next/og ImageResponsecritical - next
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedcritical - next
Next.js: Unauthenticated Remote Code Execution on windows-hosted serverscritical - next-auth
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)critical - next-auth
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headershigh - next-auth
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypasscritical - next
Next.js: Server-Side Request Forgery in Server Actions on custom servershigh - next
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamehigh - next
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localehigh - next
Next.js: Denial of Service in App Router using Server Actionshigh - axios
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloninghigh - axios
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionhigh - axios
Allocation of Resources Without Limits or Throttling in Axioshigh - axios
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapterhigh - axios
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionhigh - axios
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergehigh - axios
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`high - axios
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)high - next
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Uphigh - next
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Componentshigh - next
Next.js vulnerable to server-side request forgery in applications using WebSocket upgradeshigh - next
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routeshigh - next
Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionhigh - next
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18nhigh - next
Next.js Vulnerable to Denial of Service with Server Componentshigh - axios
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackinghigh - axios
Axios: Header Injection via Prototype Pollutionhigh - next
Next.js has a Denial of Service with Server Componentshigh - next
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Componentshigh - next
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Uphigh - next
Next Vulnerable to Denial of Service with Server Componentshigh - next
Next.js is vulnerable to RCE in React flight protocolcritical - next-auth
Missing proper state, nonce and PKCE checks for OAuth authenticationhigh - next-auth
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emailscritical - next-auth
Improper handling of email inputhigh - next-auth
Improper Handling of `callbackUrl` parameter in next-authhigh - react
Cross-Site Scripting in reacthigh