Detections
Analytics

SCA: security update for next (GHSA-ggv3-7p47-pfv8)

medium Tenable Cloud Security Plugin ID 438894

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior
 to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted
 `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement
 between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker
 could smuggle a second request to unintended backend routes (for example, internal/admin endpoints),
 bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact
 applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability
 originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by
 updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and
 `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If
 upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at
 the edge/proxy, and/or enforce authentication/authorization on backend routes. (CVE-2026-29057)

Solution

Update the next library and its related packages to version 15.5.13 or later.

See Also

https://github.com/advisories/GHSA-ggv3-7p47-pfv8

Plugin Details

Severity: Medium

ID: 438894

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/17/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.1

Percentile: 53.55

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-29057

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/17/2026

Vulnerability Publication Date: 3/17/2026

Reference Information

CVE: CVE-2026-29057

cwe: CWE-444