Spotted what might be an issue in package-lock.json around line 8962.
This HIGH severity vulnerability allows unauthorized access to protected Server-Side Rendering (SSR) JSON data through locale-less /_next/data/ endpoints. When Next.js Pages Router is configured with internationalization (i18n) and middleware-based authentication, the routing logic incorrectly bypasses middleware execution for these specific requests. Attackers can exploit this flaw to retrieve sensitive application data without passing intended authorization checks. Immediate remediation is required.
Something like this might fix it:
Update the version constraint for the next package in package.json to ^16.2.5.
- "next": "16.2.1",
+ "next": "^16.2.5",
After applying this change, run npm install (or your preferred package manager) to regenerate package-lock.json with the patched dependency tree.
For reference: rule CVE-2026-44573. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
package-lock.jsonaround line 8962.This HIGH severity vulnerability allows unauthorized access to protected Server-Side Rendering (SSR) JSON data through locale-less
/_next/data/endpoints. When Next.js Pages Router is configured with internationalization (i18n) and middleware-based authentication, the routing logic incorrectly bypasses middleware execution for these specific requests. Attackers can exploit this flaw to retrieve sensitive application data without passing intended authorization checks. Immediate remediation is required.Something like this might fix it:
For reference: rule
CVE-2026-44573. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.