Fixed in next 16.4.1 Advisory
npm install next@16.4.1
Health inspection
C
npm packages
3 criticals on the rail
Inspected live by pwned.coffee
What the inspector found
-
next .js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays -
@sentry/nextjs Sentry-Javascript: Middleware Bypass when using Tunnel route Fixed in @sentry/nextjs 9.47.2, @sentry/nextjs 10.75.2 +1 Advisorynpm install @sentry/nextjs@9.47.2 -
next .js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used Fixed in next 15.5.28, next 16.4.1 Advisorynpm install next@15.5.28
How grades work
- FSomething is exploited and has no fix.
- DSomething is exploited, but a fix exists.
- CSomething has no fix yet, or three or more criticals are on the rail.
- BHigh or critical fixes are waiting to be carried.
- ANothing serious on the rail.
Put it on your README:
[](https://pwned.coffee/grade/npm)