-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 13.0.0, < 13.5.9 | 13.5.9 |
| next | npm | >= 14.0.0, < 14.2.25 | 14.2.25 |
| next | npm | >= 15.0.0, < 15.2.3 | 15.2.3 |
| next | npm | >= 11.1.4, < 12.3.5 | 12.3.5 |
Miggo AIRoot Cause AnalysisThe analysis focused on the modified functions in the patches that directly relate to the handling of the 'x-middleware-subrequest' header. The 'initialize' function is critical as it sets up the routing and can allow unauthorized access if not properly secured. The 'filterInternalHeaders' function is essential for filtering out potentially malicious headers, and the 'context.ts' function is involved in setting headers that could be exploited. Each function was linked to specific changes in the patches that indicate their role in the vulnerability.
initializepackages/next/src/server/lib/router-server.ts
filterInternalHeaderspackages/next/src/server/lib/server-ipc/utils.ts
context.tspackages/next/src/server/web/sandbox/context.ts