-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 14.3.0-canary.77, < 15.0.5 | 15.0.5 |
| next | npm | >= 15.2.0-canary.0, < 15.2.6 | 15.2.6 |
| next | npm | >= 15.3.0-canary.0, < 15.3.6 | 15.3.6 |
| next | npm | >= 15.4.0-canary.0, < 15.4.8 | 15.4.8 |
| next | npm | >= 16.0.0-canary.0, < 16.0.7 | 16.0.7 |
| next | npm | >= 15.1.0-canary.0, < 15.1.9 | 15.1.9 |
| next | npm | >= 15.5.0-canary.0, < 15.5.7 | 15.5.7 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution issue in the React Server Components (RSC) implementation within Next.js. The analysis of the patch commit reveals that the core of the vulnerability lies in the deserialization of the RSC stream. The requireModule function, present in both client and server-side code, was missing a hasOwnProperty check before accessing module properties, making it a clear sink for prototype pollution. The server-side reviveModel and initializeModelChunk functions, which are responsible for parsing the stream and reconstructing objects, were also heavily refactored, indicating they were part of the vulnerable workflow. The patch addresses the vulnerability by adding the hasOwnProperty check in requireModule and rewriting the deserialization logic in initializeModelChunk and related functions to be more secure.
requireModulepackages/next/src/compiled/react-server-dom-turbopack/cjs/react-server-dom-turbopack-client.browser.development.js
requireModulepackages/next/src/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js
reviveModelpackages/next/src/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js
initializeModelChunkpackages/next/src/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js