deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wfc6-r584-vfw7
Package: next (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: >= 16.0.0, < 16.2.5
Patched in: 16.2.5

Summary: Next.js vulnerable to cache poisoning in React Server Component responses

Details:
### Impact

Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML.

### Fix

We now validate and interpret `RSC` request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL.

### Workarounds

If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors `Vary`, or disable shared caching for affected App Router and RSC responses.
GitHub Security Advisory: GHSA-wfc6-r584-vfw7
Package: next (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: >= 14.2.0, < 15.5.16
Patched in: 15.5.16

Summary: Next.js vulnerable to cache poisoning in React Server Component responses

Details:
### Impact

Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML.

### Fix

We now validate and interpret `RSC` request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL.

### Workarounds

If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors `Vary`, or disable shared caching for affected App Router and RSC responses.
GitHub Security Advisory: GHSA-267c-6grr-h53f
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: >= 16.0.0, < 16.2.5
Patched in: 16.2.5

Summary: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Details:
### Impact

App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted `.rsc` and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check.

### Fix

We now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.
GitHub Security Advisory: GHSA-267c-6grr-h53f
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: >= 15.2.0, < 15.5.16
Patched in: 15.5.16

Summary: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Details:
### Impact

App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted `.rsc` and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check.

### Fix

We now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.
GitHub Security Advisory: GHSA-36qx-fr4f-26g5
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 16.0.0, < 16.2.5
Patched in: 16.2.5

Summary: Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Details:
### Impact

Applications using the Pages Router with `i18n` configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less `/_next/data/<buildId>/<page>.json` requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.

### Fix
The matcher logic was updated to perform the same match as it would on a non-i18n data route.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
GitHub Security Advisory: GHSA-36qx-fr4f-26g5
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 12.2.0, < 15.5.16
Patched in: 15.5.16

Summary: Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Details:
### Impact

Applications using the Pages Router with `i18n` configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less `/_next/data/<buildId>/<page>.json` requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.

### Fix
The matcher logic was updated to perform the same match as it would on a non-i18n data route.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
GitHub Security Advisory: GHSA-w94c-4vhp-22gx
Package: @vitejs/plugin-rsc (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 0.5.25
Patched in: 0.5.26

Summary: @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

Details:
### Impact

`@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.6. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh

### Patches

Upgrade immediately to `@vitejs/plugin-rsc@0.5.26` or later.
GitHub Security Advisory: GHSA-8h8q-6873-q5fj
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 16.0.0, < 16.2.5
Patched in: 16.2.5

Summary: Next.js Vulnerable to Denial of Service with Server Components

Details:
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). 

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
GitHub Security Advisory: GHSA-8h8q-6873-q5fj
Package: next (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 13.0.0, < 15.5.16
Patched in: 15.5.16

Summary: Next.js Vulnerable to Denial of Service with Server Components

Details:
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). 

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-webpack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.2.0, < 19.2.6
Patched in: 19.2.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-turbopack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.2.0, < 19.2.6
Patched in: 19.2.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-parcel (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.2.0, < 19.2.6
Patched in: 19.2.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-webpack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.1.0, < 19.1.7
Patched in: 19.1.7

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-turbopack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.1.0, < 19.1.7
Patched in: 19.1.7

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-parcel (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.1.0, < 19.1.7
Patched in: 19.1.7

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-webpack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.0.0, < 19.0.6
Patched in: 19.0.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-turbopack (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.0.0, < 19.0.6
Patched in: 19.0.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.
GitHub Security Advisory: GHSA-rv78-f8rc-xrxh
Package: react-server-dom-parcel (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 19.0.0, < 19.0.6
Patched in: 19.0.6

Summary: Facebook React has a Denial of Service Vulnerability in React Server Components

Details:
## Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

## Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References
See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.