Skip to content

Commit cbe243e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3x4c-7xq6-9pq8 GHSA-8hq9-phh3-p2wp GHSA-ggv3-7p47-pfv8 GHSA-h27x-g6w4-24gq GHSA-jr27-m4p2-rc6r
1 parent 0753bfe commit cbe243e

5 files changed

Lines changed: 347 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-3x4c-7xq6-9pq8/GHSA-3x4c-7xq6-9pq8.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3x4c-7xq6-9pq8",
4+
"modified": "2026-03-17T16:17:06Z",
5+
"published": "2026-03-17T16:17:06Z",
6+
"aliases": [
7+
"CVE-2026-27980"
8+
],
9+
"summary": "Next.js: Unbounded next/image disk cache growth can exhaust storage",
10+
"details": "## Summary\nThe default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.\n\n## Impact\nAn attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.\n\n## Patches\nFixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. \n\n## Workarounds\nIf upgrade is not immediately possible:\n- Periodically clean `.next/cache/images`.\n- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "next"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "10.0.0"
29+
},
30+
{
31+
"fixed": "16.1.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/vercel/next.js"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/vercel/next.js/releases/tag/v16.1.7"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-400"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-17T16:17:06Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-8hq9-phh3-p2wp/GHSA-8hq9-phh3-p2wp.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hq9-phh3-p2wp",
4+
"modified": "2026-03-17T16:17:41Z",
5+
"published": "2026-03-17T16:17:41Z",
6+
"aliases": [
7+
"CVE-2026-31865"
8+
],
9+
"summary": "Elysia Cookie Value Prototype Pollution",
10+
"details": "### Impact\nElysia cookie can be overridden by prototype pollution , eg. `__proto__`\n\nSending cookie with the follows name can override cookie value:\n```bash\n__proto__=%7B%22injected%22%3A%22polluted%22%7D\n```\n\n### Patches\nPatched by 1.4.27\n\n### Workarounds\n1. Use t.Cookie validation to enforce validation value\n2. Prevent iterable over cookie if possible",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "elysia"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.4.27"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/elysiajs/elysia"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-1321"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-17T16:17:41Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-ggv3-7p47-pfv8/GHSA-ggv3-7p47-pfv8.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ggv3-7p47-pfv8",
4+
"modified": "2026-03-17T16:17:15Z",
5+
"published": "2026-03-17T16:17:15Z",
6+
"aliases": [
7+
"CVE-2026-29057"
8+
],
9+
"summary": "Next.js: HTTP request smuggling in rewrites",
10+
"details": "## Summary\nWhen Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.\n\n## Impact\nAn attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. \n\n## Patches\nThe vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.\n\n## Workarounds\nIf upgrade is not immediately possible:\n- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.\n- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "next"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "16.0.0-beta.0"
29+
},
30+
{
31+
"fixed": "16.1.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "next"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "9.5.0"
48+
},
49+
{
50+
"fixed": "15.5.13"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/vercel/next.js"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/vercel/next.js/releases/tag/v15.5.13"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/vercel/next.js/releases/tag/v16.1.7"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-444"
82+
],
83+
"severity": "MODERATE",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-17T16:17:15Z",
86+
"nvd_published_at": null
87+
}
88+
}

‎advisories/github-reviewed/2026/03/GHSA-h27x-g6w4-24gq/GHSA-h27x-g6w4-24gq.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h27x-g6w4-24gq",
4+
"modified": "2026-03-17T16:16:49Z",
5+
"published": "2026-03-17T16:16:49Z",
6+
"aliases": [
7+
"CVE-2026-27979"
8+
],
9+
"summary": "Next.js: Unbounded postponed resume buffering can lead to DoS",
10+
"details": "## Summary\nA request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.\n\n## Impact\nIn applications using the App Router with Partial Prerendering capability enabled (via `experimental.ppr` or `cacheComponents`), an attacker could send oversized `next-resume` POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.\n\n## Patches\nFixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded. \n\n## Workarounds\nIf upgrade is not immediately possible:\n- Block requests containing the `next-resume` header, as this is never valid to be sent from an untrusted client.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "next"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "16.0.1"
29+
},
30+
{
31+
"fixed": "16.1.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/vercel/next.js/commit/c885d4825f800dd1e49ead37274dcd08cdd6f3f1"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/vercel/next.js"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/vercel/next.js/releases/tag/v16.1.7"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-770"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-17T16:16:49Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-jr27-m4p2-rc6r/GHSA-jr27-m4p2-rc6r.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jr27-m4p2-rc6r",
4+
"modified": "2026-03-17T16:17:33Z",
5+
"published": "2026-03-17T16:17:33Z",
6+
"aliases": [
7+
"CVE-2026-30922"
8+
],
9+
"summary": "Denial of Service in pyasn1 via Unbounded Recursion",
10+
"details": "### Summary\nThe `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with Indefinite Length (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application.\n\nThis is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue.\n\n### Details\nThe vulnerability exists because the decoder iterates through the input stream and recursively calls `decodeFun` (the decoding callback) for every nested component found, without tracking or limiting the recursion depth.\nVulnerable Code Locations:\n1. `indefLenValueDecoder` (Line 998):\n```for component in decodeFun(substrate, asn1Spec, allowEoo=True, **options):```\nThis method handles indefinite-length constructed types. It sits inside a `while True` loop and recursively calls the decoder for every nested tag.\n\n2. `valueDecoder` (Lines 786 and 907):\n```for component in decodeFun(substrate, componentType, **options):```\nThis method handles standard decoding when a schema is present. It contains two distinct recursive calls that lack depth checks: Line 786: Recursively decodes components of `SEQUENCE` or `SET` types. Line 907: Recursively decodes elements of `SEQUENCE OF` or `SET OF` types.\n\n4. `_decodeComponentsSchemaless` (Line 661):\n```for component in decodeFun(substrate, **options):```\nThis method handles decoding when no schema is provided.\n\nIn all three cases, `decodeFun` is invoked without passing a `depth` parameter or checking against a global `MAX_ASN1_NESTING` limit.\n\n### PoC\n```\nimport sys\nfrom pyasn1.codec.ber import decoder\n\nsys.setrecursionlimit(100000)\n\nprint(\"[*] Generating Recursion Bomb Payload...\")\ndepth = 50_000\nchunk = b'\\x30\\x80' \npayload = chunk * depth\n\nprint(f\"[*] Payload size: {len(payload) / 1024:.2f} KB\")\nprint(\"[*] Triggering Decoder...\")\n\ntry:\n decoder.decode(payload)\nexcept RecursionError:\n print(\"[!] Crashed: Recursion Limit Hit\")\nexcept MemoryError:\n print(\"[!] Crashed: Out of Memory\")\nexcept Exception as e:\n print(f\"[!] Crashed: {e}\")\n```\n\n```\n[*] Payload size: 9.77 KB\n[*] Triggering Decoder...\n[!] Crashed: Recursion Limit Hit\n```\n\n### Impact\n- This is an unhandled runtime exception that typically terminates the worker process or thread handling the request. This allows a remote attacker to trivially kill service workers with a small payload (<100KB), resulting in a Denial of Service. Furthermore, in environments where recursion limits are increased, this leads to server-wide memory exhaustion.\n- Service Crash: Any service using `pyasn1` to parse untrusted ASN.1 data (e.g., LDAP, SNMP, Kerberos, X.509 parsers) can be crashed remotely.\n- Resource Exhaustion: The attack consumes RAM linearly with the nesting depth. A small payload (<200KB) can consume hundreds of megabytes of RAM or exhaust the stack.\n\n### Credits\nVulnerability discovered by Kevin Tu of TMIR at ByteDance.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "pyasn1"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.6.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.6.2"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/pyasn1/pyasn1"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-674"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-17T16:17:33Z",
66+
"nvd_published_at": null
67+
}
68+
}

0 commit comments

Comments
 (0)