next-11.1.2.tgz: 20 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - next-11.1.2.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-11.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (next version)	Remediation Possible**
CVE-2023-42282	Critical	9.8	ip-1.1.5.tgz	Transitive	11.1.3-canary.0	❌
CVE-2022-37601	Critical	9.8	loader-utils-1.2.3.tgz	Transitive	12.0.9-canary.1	❌
CVE-2021-42740	Critical	9.8	shell-quote-1.7.2.tgz	Transitive	12.0.2-canary.9	❌
CVE-2024-48949	Critical	9.1	elliptic-6.5.4.tgz	Transitive	11.1.3-canary.0	❌
CVE-2024-29415	Critical	9.1	ip-1.1.5.tgz	Transitive	N/A*	❌
CVE-2024-51479	High	7.5	next-11.1.2.tgz	Direct	13.5.8	❌
CVE-2024-4068	High	7.5	braces-3.0.2.tgz	Transitive	N/A*	❌
CVE-2022-37603	High	7.5	loader-utils-1.2.3.tgz	Transitive	12.0.9-canary.1	❌
CVE-2021-43803	High	7.5	next-11.1.2.tgz	Direct	11.1.3-canary.0	❌
CVE-2021-3807	High	7.5	ansi-regex-3.0.0.tgz	Transitive	11.1.3-canary.0	❌
CVE-2024-28863	Medium	6.5	tar-6.1.11.tgz	Transitive	N/A*	❌
CVE-2023-46234	Medium	6.5	browserify-sign-4.2.1.tgz	Transitive	11.1.3-canary.0	❌
CVE-2022-0235	Medium	6.1	node-fetch-2.6.1.tgz	Transitive	11.1.4	❌
CVE-2024-47831	Medium	5.9	next-11.1.2.tgz	Direct	13.5.8	❌
CVE-2022-23646	Medium	5.9	next-11.1.2.tgz	Direct	12.0.11-canary.10	❌
CVE-2023-44270	Medium	5.3	postcss-8.2.15.tgz	Transitive	13.5.4-canary.8	❌
CVE-2022-25881	Medium	5.3	http-cache-semantics-4.1.0.tgz	Transitive	11.1.3-canary.0	❌
CVE-2024-48948	Medium	4.8	elliptic-6.5.4.tgz	Transitive	N/A*	❌
CVE-2024-55565	Medium	4.3	nanoid-3.1.28.tgz	Transitive	11.1.3-canary.0	❌
CVE-2021-23566	Medium	4.0	nanoid-3.1.28.tgz	Transitive	11.1.3-canary.0	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-42282

Vulnerable Library - ip-1.1.5.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • fsevents-2.3.2.tgz
      • node-gyp-8.2.0.tgz
        • make-fetch-happen-8.0.14.tgz
          • socks-proxy-agent-5.0.1.tgz
            • socks-2.6.1.tgz
              • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2022-37601

Vulnerable Library - loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • styled-jsx-4.0.1.tgz
    • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (next): 12.0.9-canary.1

Step up your Open Source Security Game with Mend here

CVE-2021-42740

Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • react-dev-overlay-11.1.2.tgz
    • ❌ shell-quote-1.7.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (next): 12.0.2-canary.9

Step up your Open Source Security Game with Mend here

CVE-2024-48949

Vulnerable Library - elliptic-6.5.4.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • crypto-browserify-3.12.0.tgz
    • browserify-sign-4.2.1.tgz
      • ❌ elliptic-6.5.4.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

Publish Date: 2024-10-10

URL: CVE-2024-48949

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949

Release Date: 2024-10-10

Fix Resolution (elliptic): 6.5.6

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2024-29415

Vulnerable Library - ip-1.1.5.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • fsevents-2.3.2.tgz
      • node-gyp-8.2.0.tgz
        • make-fetch-happen-8.0.14.tgz
          • socks-proxy-agent-5.0.1.tgz
            • socks-2.6.1.tgz
              • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Mend Note: We assigned a different CVSS score to this CVE because of its potential to result in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, the package is no longer maintained, which increases the associated risk.

Publish Date: 2024-05-27

URL: CVE-2024-29415

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-51479

Vulnerable Library - next-11.1.2.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-11.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-11.1.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] "https://example.com/" * [Affected] "https://example.com/foo" * [Not affected] "https://example.com/foo/bar". This issue is patched in Next.js "14.2.15" and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

Publish Date: 2024-12-17

URL: CVE-2024-51479

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7gfc-8cq8-jh5f

Release Date: 2024-12-17

Fix Resolution: 13.5.8

Step up your Open Source Security Game with Mend here

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

Step up your Open Source Security Game with Mend here

CVE-2022-37603

Vulnerable Library - loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • styled-jsx-4.0.1.tgz
    • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 1.4.2

Direct dependency fix Resolution (next): 12.0.9-canary.1

Step up your Open Source Security Game with Mend here

CVE-2021-43803

Vulnerable Library - next-11.1.2.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-11.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-11.1.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

Publish Date: 2021-12-09

URL: CVE-2021-43803

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-25mp-g6fv-mqxx

Release Date: 2021-12-09

Fix Resolution: 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • fsevents-2.3.2.tgz
      • node-gyp-8.2.0.tgz
        • npmlog-4.1.2.tgz
          • gauge-2.7.4.tgz
            • wide-align-1.1.3.tgz
              • string-width-2.1.1.tgz
                • strip-ansi-4.0.0.tgz
                  • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2024-28863

Vulnerable Library - tar-6.1.11.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • fsevents-2.3.2.tgz
      • node-gyp-8.2.0.tgz
        • ❌ tar-6.1.11.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

Step up your Open Source Security Game with Mend here

CVE-2023-46234

Vulnerable Library - browserify-sign-4.2.1.tgz

adds node crypto signing for browsers

Library home page: https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • crypto-browserify-3.12.0.tgz
    • ❌ browserify-sign-4.2.1.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

Publish Date: 2023-10-26

URL: CVE-2023-46234

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x9w5-v3q2-3rhw

Release Date: 2023-10-26

Fix Resolution (browserify-sign): 4.2.2

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (next): 11.1.4

Step up your Open Source Security Game with Mend here

CVE-2024-47831

Vulnerable Library - next-11.1.2.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-11.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-11.1.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the next.config.js file that is configured with images.unoptimized set to true or images.loader set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js 14.2.7. As a workaround, ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Publish Date: 2024-10-14

URL: CVE-2024-47831

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g77x-44xx-532m

Release Date: 2024-10-14

Fix Resolution: 13.5.8

Step up your Open Source Security Game with Mend here

CVE-2022-23646

Vulnerable Library - next-11.1.2.tgz

The React Framework

Library home page: https://registry.npmjs.org/next/-/next-11.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ next-11.1.2.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Publish Date: 2022-02-17

URL: CVE-2022-23646

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23646

Release Date: 2022-02-17

Fix Resolution: 12.0.11-canary.10

Step up your Open Source Security Game with Mend here

CVE-2023-44270

Vulnerable Library - postcss-8.2.15.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.2.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • ❌ postcss-8.2.15.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution (postcss): 8.4.31

Direct dependency fix Resolution (next): 13.5.4-canary.8

Step up your Open Source Security Game with Mend here

CVE-2022-25881

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • chokidar-3.5.1.tgz
    • fsevents-2.3.2.tgz
      • node-gyp-8.2.0.tgz
        • make-fetch-happen-8.0.14.tgz
          • ❌ http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rc47-6667-2j5j

Release Date: 2023-01-31

Fix Resolution (http-cache-semantics): 4.1.1

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2024-48948

Vulnerable Library - elliptic-6.5.4.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • crypto-browserify-3.12.0.tgz
    • browserify-sign-4.2.1.tgz
      • ❌ elliptic-6.5.4.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

Publish Date: 2024-10-15

URL: CVE-2024-48948

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fc9h-whq2-v747

Release Date: 2024-10-15

Fix Resolution: elliptic - 6.6.0

Step up your Open Source Security Game with Mend here

CVE-2024-55565

Vulnerable Library - nanoid-3.1.28.tgz

A tiny (108 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.28.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • postcss-8.2.15.tgz
    • ❌ nanoid-3.1.28.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

Publish Date: 2024-12-09

URL: CVE-2024-55565

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-55565

Release Date: 2024-12-09

Fix Resolution (nanoid): 3.3.8

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here

CVE-2021-23566

Vulnerable Library - nanoid-3.1.28.tgz

A tiny (108 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.28.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-11.1.2.tgz (Root Library)
  • postcss-8.2.15.tgz
    • ❌ nanoid-3.1.28.tgz (Vulnerable Library)

Found in HEAD commit: e1db6833fb15baf6aa472bac4d5a4279dd618797

Found in base branch: main

Vulnerability Details

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Publish Date: 2022-01-14

URL: CVE-2021-23566

CVSS 3 Score Details (4.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-14

Fix Resolution (nanoid): 3.1.31

Direct dependency fix Resolution (next): 11.1.3-canary.0

Step up your Open Source Security Game with Mend here