Spectra Assure

failRisk: Vulnerabilities

Scanned:

gemooy

latest

License: Permissive (ISC)

Published:

Visit GitHub

See on npm

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

4 severe vulnerabilities exploited

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/04/01

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

CVSS Score

CVE

Summary

Tags

critical

9.1

CVE-2025-29927

Next.js is vulnerable to authorization bypass due to incorrect middleware checks.

Exploited by Malware

Exploits Exist

Fix Available

high

8.7

CVE-2024-46982

Next.js is vulnerable to cache poisoning via crafted HTTP requests, potentially caching non-dynamic server-side rendered routes.

Exploited by Malware

Exploits Exist

Fix Available

high

8.2

CVE-2025-57822

Next.js is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect handling of user-supplied headers in self-hosted applications.

Exploits Exist

Fix Available

high

7.5

CVE-2024-51479

Next.js is vulnerable to authorization bypass when performing authorization in middleware based on pathname.

Exploits Exist

Fix Available

high

7.5

CVE-2025-59471

Next.js is vulnerable to a denial of service attack via the Image Optimizer endpoint.

Fix Available

medium

6.2

CVE-2025-57752

Next.js Image Optimization API routes are vulnerable to cache key confusion, potentially serving images to unauthorized users.

Fix Available

medium

5.3

CVE-2024-56332

Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leave Server Actions hanging.

Fix Available

medium

4.6

CVE-2024-47831

Next.js is vulnerable to a Denial of Service (DoS) condition due to excessive CPU consumption in its image optimization feature.

Fix Available

medium

4.3

CVE-2025-55173

Next.js is vulnerable to content injection via Image Optimization, allowing attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames.

Fix Available

low

3.7

CVE-2025-32421

Next.js has a race-condition vulnerability in the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.

Exploits Exist

Fix Available