IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.6Alta

CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades

vercel next.js; Red Hat Streams for Apache Kafka 2.9.4; Red Hat Red Hat Trusted Artifact Signer 1.3; Red Hat Red Hat Trusted Artifact Signer 1.4 Publicada: (hace 6 meses)

Descripción

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Debilidad (CWE): CWE-918

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 2.9 —
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
Red Hat Red Hat Trusted Artifact Signer 1.4 all versions
Red Hat Streams for Apache Kafka 2.9.4 —
Red Hat streams for Apache Kafka 3 all versions
trusted artifact signer 1.3 —
trusted artifact signer 1.4 —
vercel next.js >= 16.0.0, < 16.2.5, >= 13.4.13, < 15.5.16

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 13.4.13 < 15.5.16
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 16.0.0 < 16.2.5

CVE recientes del mismo producto — Red Hat Enterprise Linux

6.5Media
CVE-2026-121885

Podman: untrusted image labels allow auto-update to restart arbitrary systemd units

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Hardened Images

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart.…

4.2Media
CVE-2026-125709

Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigg…

6.1Media
CVE-2026-125707

Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. T…

5.5Media
CVE-2026-125706

Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG …

7.5Alta
CVE-2026-125712

Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiv…