Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Next.js packages could be exploited by known security flaw
published 2 months ago
Summary
Thirteen Next.js related packages (bundle analyzer, codemod, env, eslint plugin, font, etc.) were found to contain a known security weakness. The issue has been fixed in the updated release 14.2.35-tuxcare.8, so applying this update will protect your applications.
What to do
- Update next @next/bundle-analyzer to version 14.2.35-tuxcare.8.
- Update next @next/codemod to version 14.2.35-tuxcare.8.
- Update next @next/env to version 14.2.35-tuxcare.8.
- Update next @next/eslint-plugin-next to version 14.2.35-tuxcare.8.
- Update next @next/font to version 14.2.35-tuxcare.8.
- Update next @next/mdx to version 14.2.35-tuxcare.8.
- Update next @next/plugin-storybook to version 14.2.35-tuxcare.8.
- Update next @next/polyfill-module to version 14.2.35-tuxcare.8.
- Update next @next/polyfill-nomodule to version 14.2.35-tuxcare.8.
- Update next @next/react-refresh-utils to version 14.2.35-tuxcare.8.
- Update next @next/third-parties to version 14.2.35-tuxcare.8.
- Update GitHub Actions create-next-app to version 14.2.35-tuxcare.8.
- Update GitHub Actions eslint-config-next to version 14.2.35-tuxcare.8.
- Update GitHub Actions next to version 14.2.35-tuxcare.8.
- Update create-next-app to version 14.2.35-tuxcare.8.
- Update eslint-config-next to version 14.2.35-tuxcare.8.
- Update next to version 14.2.35-tuxcare.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | next | @next/bundle-analyzer |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/codemod |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/env |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/eslint-plugin-next |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/font |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/mdx |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/plugin-storybook |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/polyfill-module |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/polyfill-nomodule |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/react-refresh-utils |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | next | @next/third-parties |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | GitHub Actions | create-next-app |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | GitHub Actions | eslint-config-next |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | GitHub Actions | next |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | – | create-next-app |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | – | eslint-config-next |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
| TuxCare:npm | – | next |
< 14.2.35-tuxcare.8 Fix: upgrade to 14.2.35-tuxcare.8
|
Original advisory text
TuxCare security update for 13 packages (1 CVE)
TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.8.
Timeline
Published20 Aug 2026
Updated13 Oct 2026
First seen15 Sep 2026
Sources
CLSA-2026-1787236015 · OSV
Track software like this
Free during beta