VYN / REGISTER

Buglist

A technical record of reported vulnerabilities, including impact, root cause, and exploitation conditions.

CVE-2026-75604Aug 25, 2026

Next.js ISR cache path traversal bypasses Proxy and enables RCE on Windows

A mismatch between the authorized route and the path used by FileSystemCache exposed protected artifacts and, under specific conditions, allowed unauthenticated code execution.

Next.jsPath traversal9.0 / CriticalFixed

CVE-2026-64648Jul 21, 2026

fetch(Request, init) cache-key confusion leaks POST responses across users

Next.js derived the cache identity from a different request than the one sent upstream.

Next.jsCache confusion6.0 / MediumFixed