vercel/next.js

shell-quote 1.7.3

2 advisories. Fixed in 1.9.0.

How it can be abusedAn attacker could send specially crafted shell command strings to code that calls shell-quote's parse(), making the parser slow down dramatically and hang the process, or exploit the quoting flaw to sneak newlines into commands meant to be safely escaped. Here that only matters for build scripts and internal tooling that run on trusted, developer-supplied input, so ordinary users of apps built with this framework are not affected.

• highGHSA-395f-4hp3-45gvshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
• criticalGHSA-w7jw-789q-3m8pshell-quote quote() does not escape newlines in object .op values

cross-spawn 6.0.5

1 advisory. Fixed in 7.0.5.

How it can be abusedThis package launches child processes and has a flaw where certain crafted command strings make it hang while processing them with an inefficient pattern match. In this repo it only runs during local development and builds, when developers or their own scripts run CLI commands like 'next build', so an attacker would need control over the command line arguments being spawned, which normal users of apps built with Next.js never have.

• highGHSA-3xgq-45jj-v275Regular Expression Denial of Service (ReDoS) in cross-spawn

dd-trace 4.12.0

1 advisory. Fixed in 5.100.0.

How it can be abusedAn attacker could send specially crafted W3C baggage headers with requests to a running server, and the flawed header parsing could exhaust resources and crash the process. This affects anyone serving an application that uses dd-trace to instrument its HTTP traffic; in this repo dd-trace is only used for internal tooling, not shipped to framework users.

• highGHSA-wxqq-gcq8-c443dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

image-size 1.2.1

2 advisories.

How it can be abusedAn attacker can send a specially crafted JXL, HEIF, or ICNS image that makes the parser loop forever, hanging the process. In this repo, image-size is used during image handling in the framework, so anyone building an app that processes untrusted user-supplied images through next/image could have their server or build freeze up.

• highGHSA-5p2g-fcmc-qvqqimage-size: JXL and HEIF parsers allow denial of service through infinite loops
• highGHSA-w3rx-r6r6-pgprimage-size: ICNS parser allows denial of service through an infinite loop

js-yaml 4.2.0

2 advisories. Fixed in 3.15.0.

How it can be abusedA malicious or crafted YAML file with deeply chained merge keys could make the parser hang the CPU for a long time when loaded, freezing a developer's build or CI run. This mainly affects people running Next.js development tooling or tests on untrusted YAML content, not production apps serving users.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

minimatch 3.0.4

4 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker could craft a long or unusual file path that makes the pattern matcher hang while checking filenames during builds or file serving, freezing the process until it finishes. This mainly affects developers running builds and any server that matches user-influenced paths against glob patterns.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
• highGHSA-f8q6-p94x-37v3minimatch ReDoS vulnerability

moment 2.24.0

2 advisories. Fixed in 2.29.2.

How it can be abusedIf an app served or built with this codebase let outside users pick a locale name or feed dates into moment, an attacker could make it read files from other folders or send crafted strings that hang the CPU for a long time. In this repo moment is only used in build scripts and tests, not to handle real user input at runtime.

• highGHSA-8hfj-j24r-96c4Path Traversal: 'dir/../../filename' in moment.locale
• highGHSA-wc69-rhjr-hc9gMoment.js vulnerable to Inefficient Regular Expression Complexity

nanoid 3.1.30

2 advisories. Fixed in 3.3.16.

How it can be abusedAn attacker would need to control the size argument passed to nanoid in your code, since passing zero or a negative number makes the generator spin forever instead of returning an ID, hanging that request or process. Next.js itself uses nanoid with fixed sizes internally, so this mainly matters if your own application code feeds user input into nanoid's size parameter.

• highGHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
• highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero

octokit 3.1.0

1 advisory. Fixed in 9.26.3.

How it can be abusedAn attacker could send crafted fake webhook requests to crash a service that uses octokit's webhook handling, knocking it offline until restarted. In this repo octokit is only used by internal development and CI scripts that talk to GitHub's API, so it never ships to end users of Next.js.

• highGHSA-pwfr-8pq7-x9qvUnauthenticated Denial of Service in the octokit/webhooks library

semver 7.3.7

1 advisory. Fixed in 7.5.2.

How it can be abusedAn attacker could feed a crafted version string, such as through a malicious package name or version in a lockfile or registry response, into code that parses versions with semver. The flawed regex then hangs the process for a long time. In Next.js this mainly affects developers running installs and builds, not end users visiting sites.

• highGHSA-c2qf-rxjj-qqgwsemver vulnerable to Regular Expression Denial of Service

ws 8.2.3

2 advisories. Fixed in 5.2.4.

How it can be abusedAn attacker could crash the development server by sending it crafted websocket requests, such as one with thousands of headers or many tiny message fragments that pile up in memory. Only developers running Next.js locally or anyone exposing a dev server would be hit; production apps do not ship this package.

• highGHSA-3h5v-q93c-6h6qws affected by a DoS when handling a request with many HTTP headers
• highGHSA-96hv-2xvq-fx4pws: Memory exhaustion DoS from tiny fragments and data chunks