2026-10
“linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text”osv.dev ›
“lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit”osv.dev ›
“Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used”osv.dev ›
“Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes”osv.dev ›
“Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up”osv.dev ›
“Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used”osv.dev ›
“Next.js has information disclosure in development server's Model Context Protocol endpoint”osv.dev ›
“Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences”osv.dev ›
“Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays”osv.dev ›
“Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale”osv.dev ›
“Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration”osv.dev ›
“Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades”osv.dev ›
“Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass”osv.dev ›
“Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces”osv.dev ›
2026-11
“lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit”osv.dev ›
“Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions”osv.dev ›
“minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions”osv.dev ›
“minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments”osv.dev ›