GHSA-p3m5-59mp-jv5r found in npm/[email protected]
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 1/5
- Tiempo estimado
- 1-3 horas
- Aptitud para principiantes
- 64/100
Línea de trabajo
Empieza por localizar el manifiesto de paquetes del sitio de documentación y comprobar la versión instalada de Next.js frente a la versión afectada indicada, 16.3.8. Actualiza Next.js a la versión 16.4.1 o posterior y luego ejecuta npm audit para confirmar que se ha resuelto la vulnerabilidad indicada.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
GHSA-p3m5-59mp-jv5r found in npm/[email protected]
[!important]
Risk:1.30 (Low)
CVSS:8.2
Description
Impact
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
Workarounds
No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
Affected component
The vulnerability is in pkg:npm/[email protected], found in artifacts pkg:devguard/l3montree-cybersecurity/devguard/devguard-documentation, pkg:oci/devguard-documentation?repository_url=ghcr.io/l3montree-dev/devguard-documentation&arch=amd64&tag=main-amd64.
Recommended fix
Upgrade to version 16.4.1 or later.
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install [email protected]
Additional guidance for mitigating vulnerabilities
Visit our guides on devguard.org
See more details...
Path to component
%%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
flowchart TD
Your_application(["Your application"]) --- pkg_npm_next_16_3_8(["pkg:npm/next\@16.3.8"])
classDef default stroke-width:2px
| Risk Factor | Value | Description |
|---|---|---|
| Vulnerability Depth | 1 |
The vulnerability is in a direct dependency of your project. |
| EPSS | 0.36 % |
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. |
| EXPLOIT | Not available |
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. |
| CVSS-BE | 6.9 |
|
| CVSS-B | 8.2 |
- The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. |
More details can be found in DevGuard
Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:
👍 Reply with this to acknowledge and accept the identified risk.
/accept I accept the risk of this vulnerability, because ...
⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
/component-not-present The vulnerable component is not included in the artifact.
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
/reopen ...
- Lenguaje dominante
- MDX
- Estrellas
- 8
- Forks
- 4
- Merge medio
- 3 d 9 h
- PR fusionados (30 d)
- 7
Preparar el entorno
- Incluye un Dockerfile o un archivo de Docker Compose
- Sin plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Issues similares
-
automation doc-healer documentation
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
tsukumogami/tsuku#2803 ·
Los mantenedores suelen responder en 1 día
-
merge-prevention: fail-by-label reports success when get-pr-info fails, letting a do-not-merge PR throughPosiblemente ocupada @scottschreckengaust la tomó hoy. Abiertobug needs-triage
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
Los mantenedores suelen responder en 1 día
-
area: tests-ci type: feature
Dificultad 2/5 1-3 horas Aptitud para principiantes 85/100
dotnetdork/Labyrinth#128 ·
Los mantenedores suelen responder en 1 día
-
area:build priority:P2 status:backlog
Dificultad 2/5 1-3 horas Aptitud para principiantes 85/100
KD5UJC-XYZ/scarab#648 ·
Los mantenedores suelen responder en 1 día