The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and     prior to version 16.1.7, `origin: null` was treated as a missing origin during Server Action CSRF     validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin     verification instead of being validated as cross-origin requests. An attacker could induce a victim     browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions     with victim credentials (CSRF). This is fixed in version 16.1.7 by treating `'null'` as an explicit origin     value and enforcing host/origin checks unless `'null'` is explicitly allowlisted in     `experimental.serverActions.allowedOrigins`. If upgrading is not immediately possible, add CSRF tokens for     sensitive Server Actions, prefer `SameSite=Strict` on sensitive auth cookies, and/or do not allow `'null'`     in `serverActions.allowedOrigins` unless intentionally required and additionally protected.
    (CVE-2026-27978)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-27978

medium Nessus Plugin ID 302959

Version 1.2

Version 1.1

Version 1.2 Mar 20, 2026, 10:49 AM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N") Plugin Feed: 202603201049
Version 1.1 Mar 19, 2026, 12:10 PM New Plugin Feed: 202603191210