Skip to content

Commit 1166db8

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Auto-update jsrepository: next | GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36 (#616)
Updated libraries (1): next Updated vulnerability IDs (2): GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36 Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 7ddda63 commit 1166db8

9 files changed

Lines changed: 791 additions & 0 deletions

‎repository/jsrepository-master.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11221,6 +11221,69 @@
1122111221
"https://github.com/vercel/next.js/releases/tag/v15.5.21",
1122211222
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1122311223
]
11224+
},
11225+
{
11226+
"ranges": [
11227+
{
11228+
"atOrAbove": "10.0.0",
11229+
"below": "15.5.24"
11230+
},
11231+
{
11232+
"atOrAbove": "16.0.0",
11233+
"below": "16.3.3"
11234+
}
11235+
],
11236+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
11237+
"details": "A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.",
11238+
"identifiers": {
11239+
"githubID": "GHSA-2xp9-vwfh-vxw4"
11240+
},
11241+
"severity": "critical",
11242+
"cwe": [
11243+
"CWE-1395"
11244+
],
11245+
"info": [
11246+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
11247+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
11248+
"https://github.com/vercel/next.js/pull/97875",
11249+
"https://github.com/vercel/next.js/pull/97931",
11250+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
11251+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
11252+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
11253+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
11254+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
11255+
]
11256+
},
11257+
{
11258+
"ranges": [
11259+
{
11260+
"atOrAbove": "13.4.0",
11261+
"below": "15.5.24"
11262+
},
11263+
{
11264+
"atOrAbove": "16.0.0",
11265+
"below": "16.3.3"
11266+
}
11267+
],
11268+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
11269+
"details": "## Impact\n\nA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.\n\n## Workaround\n\nThere is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.",
11270+
"identifiers": {
11271+
"githubID": "GHSA-p293-qw3h-jr36",
11272+
"CVE": [
11273+
"CVE-2026-75604"
11274+
]
11275+
},
11276+
"severity": "critical",
11277+
"cwe": [
11278+
"CWE-22"
11279+
],
11280+
"info": [
11281+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
11282+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
11283+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
11284+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
11285+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
11286+
]
1122411287
}
1122511288
],
1122611289
"extractors": {

‎repository/jsrepository-v2.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12084,6 +12084,51 @@
1208412084
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1208512085
]
1208612086
},
12087+
{
12088+
"atOrAbove": "10.0.0",
12089+
"below": "15.5.24",
12090+
"severity": "critical",
12091+
"cwe": [
12092+
"CWE-1395"
12093+
],
12094+
"identifiers": {
12095+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
12096+
"githubID": "GHSA-2xp9-vwfh-vxw4"
12097+
},
12098+
"info": [
12099+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
12100+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
12101+
"https://github.com/vercel/next.js/pull/97875",
12102+
"https://github.com/vercel/next.js/pull/97931",
12103+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
12104+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
12105+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
12106+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12107+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12108+
]
12109+
},
12110+
{
12111+
"atOrAbove": "13.4.0",
12112+
"below": "15.5.24",
12113+
"severity": "critical",
12114+
"cwe": [
12115+
"CWE-22"
12116+
],
12117+
"identifiers": {
12118+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
12119+
"githubID": "GHSA-p293-qw3h-jr36",
12120+
"CVE": [
12121+
"CVE-2026-75604"
12122+
]
12123+
},
12124+
"info": [
12125+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
12126+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
12127+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
12128+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12129+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12130+
]
12131+
},
1208712132
{
1208812133
"atOrAbove": "15.6.0-canary.0",
1208912134
"below": "15.6.0-canary.59",
@@ -12966,6 +13011,51 @@
1296613011
"https://github.com/vercel/next.js/releases/tag/v15.5.21",
1296713012
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1296813013
]
13014+
},
13015+
{
13016+
"atOrAbove": "16.0.0",
13017+
"below": "16.3.3",
13018+
"severity": "critical",
13019+
"cwe": [
13020+
"CWE-1395"
13021+
],
13022+
"identifiers": {
13023+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
13024+
"githubID": "GHSA-2xp9-vwfh-vxw4"
13025+
},
13026+
"info": [
13027+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
13028+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
13029+
"https://github.com/vercel/next.js/pull/97875",
13030+
"https://github.com/vercel/next.js/pull/97931",
13031+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
13032+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
13033+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
13034+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13035+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13036+
]
13037+
},
13038+
{
13039+
"atOrAbove": "16.0.0",
13040+
"below": "16.3.3",
13041+
"severity": "critical",
13042+
"cwe": [
13043+
"CWE-22"
13044+
],
13045+
"identifiers": {
13046+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
13047+
"githubID": "GHSA-p293-qw3h-jr36",
13048+
"CVE": [
13049+
"CVE-2026-75604"
13050+
]
13051+
},
13052+
"info": [
13053+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
13054+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
13055+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
13056+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13057+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13058+
]
1296913059
}
1297013060
],
1297113061
"extractors": {

‎repository/jsrepository-v3.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12246,6 +12246,51 @@
1224612246
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1224712247
]
1224812248
},
12249+
{
12250+
"atOrAbove": "10.0.0",
12251+
"below": "15.5.24",
12252+
"severity": "critical",
12253+
"cwe": [
12254+
"CWE-1395"
12255+
],
12256+
"identifiers": {
12257+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
12258+
"githubID": "GHSA-2xp9-vwfh-vxw4"
12259+
},
12260+
"info": [
12261+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
12262+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
12263+
"https://github.com/vercel/next.js/pull/97875",
12264+
"https://github.com/vercel/next.js/pull/97931",
12265+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
12266+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
12267+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
12268+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12269+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12270+
]
12271+
},
12272+
{
12273+
"atOrAbove": "13.4.0",
12274+
"below": "15.5.24",
12275+
"severity": "critical",
12276+
"cwe": [
12277+
"CWE-22"
12278+
],
12279+
"identifiers": {
12280+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
12281+
"githubID": "GHSA-p293-qw3h-jr36",
12282+
"CVE": [
12283+
"CVE-2026-75604"
12284+
]
12285+
},
12286+
"info": [
12287+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
12288+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
12289+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
12290+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12291+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12292+
]
12293+
},
1224912294
{
1225012295
"atOrAbove": "15.6.0-canary.0",
1225112296
"below": "15.6.0-canary.59",
@@ -13128,6 +13173,51 @@
1312813173
"https://github.com/vercel/next.js/releases/tag/v15.5.21",
1312913174
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1313013175
]
13176+
},
13177+
{
13178+
"atOrAbove": "16.0.0",
13179+
"below": "16.3.3",
13180+
"severity": "critical",
13181+
"cwe": [
13182+
"CWE-1395"
13183+
],
13184+
"identifiers": {
13185+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
13186+
"githubID": "GHSA-2xp9-vwfh-vxw4"
13187+
},
13188+
"info": [
13189+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
13190+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
13191+
"https://github.com/vercel/next.js/pull/97875",
13192+
"https://github.com/vercel/next.js/pull/97931",
13193+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
13194+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
13195+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
13196+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13197+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13198+
]
13199+
},
13200+
{
13201+
"atOrAbove": "16.0.0",
13202+
"below": "16.3.3",
13203+
"severity": "critical",
13204+
"cwe": [
13205+
"CWE-22"
13206+
],
13207+
"identifiers": {
13208+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
13209+
"githubID": "GHSA-p293-qw3h-jr36",
13210+
"CVE": [
13211+
"CVE-2026-75604"
13212+
]
13213+
},
13214+
"info": [
13215+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
13216+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
13217+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
13218+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13219+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13220+
]
1313113221
}
1313213222
],
1313313223
"extractors": {

‎repository/jsrepository-v4.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12245,6 +12245,51 @@
1224512245
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1224612246
]
1224712247
},
12248+
{
12249+
"atOrAbove": "10.0.0",
12250+
"below": "15.5.24",
12251+
"severity": "critical",
12252+
"cwe": [
12253+
"CWE-1395"
12254+
],
12255+
"identifiers": {
12256+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
12257+
"githubID": "GHSA-2xp9-vwfh-vxw4"
12258+
},
12259+
"info": [
12260+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
12261+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
12262+
"https://github.com/vercel/next.js/pull/97875",
12263+
"https://github.com/vercel/next.js/pull/97931",
12264+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
12265+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
12266+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
12267+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12268+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12269+
]
12270+
},
12271+
{
12272+
"atOrAbove": "13.4.0",
12273+
"below": "15.5.24",
12274+
"severity": "critical",
12275+
"cwe": [
12276+
"CWE-22"
12277+
],
12278+
"identifiers": {
12279+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
12280+
"githubID": "GHSA-p293-qw3h-jr36",
12281+
"CVE": [
12282+
"CVE-2026-75604"
12283+
]
12284+
},
12285+
"info": [
12286+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
12287+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
12288+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
12289+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
12290+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
12291+
]
12292+
},
1224812293
{
1224912294
"atOrAbove": "15.6.0-canary.0",
1225012295
"below": "15.6.0-canary.59",
@@ -13127,6 +13172,51 @@
1312713172
"https://github.com/vercel/next.js/releases/tag/v15.5.21",
1312813173
"https://github.com/vercel/next.js/releases/tag/v16.2.11"
1312913174
]
13175+
},
13176+
{
13177+
"atOrAbove": "16.0.0",
13178+
"below": "16.3.3",
13179+
"severity": "critical",
13180+
"cwe": [
13181+
"CWE-1395"
13182+
],
13183+
"identifiers": {
13184+
"summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used",
13185+
"githubID": "GHSA-2xp9-vwfh-vxw4"
13186+
},
13187+
"info": [
13188+
"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497",
13189+
"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4",
13190+
"https://github.com/vercel/next.js/pull/97875",
13191+
"https://github.com/vercel/next.js/pull/97931",
13192+
"https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3",
13193+
"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2",
13194+
"https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998",
13195+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13196+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13197+
]
13198+
},
13199+
{
13200+
"atOrAbove": "16.0.0",
13201+
"below": "16.3.3",
13202+
"severity": "critical",
13203+
"cwe": [
13204+
"CWE-22"
13205+
],
13206+
"identifiers": {
13207+
"summary": "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",
13208+
"githubID": "GHSA-p293-qw3h-jr36",
13209+
"CVE": [
13210+
"CVE-2026-75604"
13211+
]
13212+
},
13213+
"info": [
13214+
"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36",
13215+
"https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b",
13216+
"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3",
13217+
"https://github.com/vercel/next.js/releases/tag/v15.5.24",
13218+
"https://github.com/vercel/next.js/releases/tag/v16.3.3"
13219+
]
1313013220
}
1313113221
],
1313213222
"extractors": {

0 commit comments

Comments
 (0)