Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Next.js

Source -

CNA

CNA CVEs -

1

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated VendorsRelated AssignersReports
1Vulnerabilities found
CVE-2025-13984
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.03% / 8.35%
||
7 Day CHG~0.00%
Published-28 Jan, 2026 | 20:02
Updated-06 Feb, 2026 | 19:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

Action-Not Available
Vendor-kanopiThe Drupal Association
Product-next.jsNext.js
CWE ID-CWE-942
Permissive Cross-domain Policy with Untrusted Domains