{ "schema": "varexis-index-delivery/1", "catalog_version": "osv-canonical-20261013-v1", "route_id": "agentic_pack_nextjs_advisory_snapshot_v1", "question": "Next.js: three dated advisory sources?", "answer": "These three dated Next.js advisory projections preserve the selected affected/fixed source assertions and their separately dated enrichment. This selection is not complete coverage or an assessment of an installed deployment.", "records": [ { "record_id": "VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5", "url": "/api/index/advisories?record_id=VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5", "content_sha256": "a18c69b504000fbbca2c48afa4c2442f03b393261a859a4e38e349164cf4c0e6", "evidence": { "admission": { "agent_boundary": { "prohibited_inference": [ "DO_NOT_INFER_PACKAGE_SAFETY_FROM_ABSENCE", "DO_NOT_INFER_DEPLOYMENT_AFFECTEDNESS_WITHOUT_VERSION_CONTEXT", "DO_NOT_TREAT_FIX_EVENT_AS_DEPLOYMENT_RECOMMENDATION", "DO_NOT_TREAT_EPSS_AS_SEVERITY_OR_LOCAL_RISK", "DO_NOT_TREAT_KEV_ABSENCE_AS_NO_EXPLOITATION" ], "requires_human_review": false, "routing_action": "RETURN_WITH_BOUNDARY", "safe_usage": "Evidence interpretation only. Not certification, approval, legal advice, financial advice, security deployment advice, or a determination that a system or product is safe. Absence of a listed vulnerability, exploitation indicator, affected condition, mitigation, or fix does not establish safety or non-affected status." }, "canonical_record_sha256": "86e052f4aaa150578b14467d8c6dd4ccb26c92db591b54cd8a58536eae63c36a", "coverage_class": "SOURCE_COMPLETE", "disqualification": { "disqualifiers": [], "refusal_triggers": [] }, "lineage": "S2_WITH_S1_LINEAGE", "policy": "WHOLE_AMBIGUOUS_GROUPS_EXCLUDED_V1", "rights_review": "ATTRIBUTED_PROJECTION_APPROVED", "source_projection_sha256": "94cfc4e50d0b193c05367ae9620abcf489d450520ba49dd46d3370b28f1dd523", "uncertainty": { "ambiguities": [], "conflicts": [], "missing_evidence": [], "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ] } }, "advisory_id": "GHSA-g77x-44xx-532m", "affected": { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-g77x-44xx-532m/GHSA-g77x-44xx-532m.json" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "ranges": [ { "events": [ { "introduced": "10.0.0" }, { "fixed": "14.2.7" } ], "type": "SEMVER" } ] }, "aliases": [ "CVE-2024-47831" ], "attribution": { "changes": "Attributed affected-package projection with dated enrichment and canonical admission boundaries. Narrative and internal priority fields omitted; original credits and source bindings retained. No endorsement.", "licence": "CC-BY-4.0", "notices": "https://varexis.tech/varexis-index/advisory-attribution.json", "publisher": "GitHub Advisory Database contributors", "source": "https://github.com/github/advisory-database" }, "authority_boundary": { "exploitability_verified": false, "full_schema_validation": false, "package_safe_claim": false, "version_range_evaluation": "NOT_IMPLEMENTED_REQUIRES_ECOSYSTEM_RESOLVER" }, "credits": [], "dataset_id": "osv-canonical-20261013-v1", "enrichment": { "boundary": "Direct CVE joins to captured feeds. Missing scores are unknown, not zero; absence is not safety.", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 260863, "cve": "CVE-2024-47831", "percentile": 0.52976, "probability": 0.00732 } ] }, "fixed_events": [ { "kind": "fixed", "projection_pointer": "/affected/ranges/0/events/1/fixed", "range_type": "SEMVER", "repository": null, "source_pointer": "/affected/0/ranges/0/events/1/fixed", "value": "14.2.7" } ], "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "live_revalidation": false }, "evidence_class": "EXTERNAL_SOURCE_ASSERTION_NOT_INDEPENDENT_VERIFICATION", "freshness": { "captured_on": "2026-10-08", "live_revalidation": false, "reviewed_on": "2026-10-13" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "provenance": { "advisory_canonical_sha256": "dcfc9dedba36e871c86452cb9ff69e68f2348508ec9583225406800a6f783bdf", "json_pointer": "/affected/0", "origins": [ { "archive_sha256": "87b192af2f38d0da54d8bf43a70f4c6343ce0211099545cf2fa9fae36a5978e0", "archive_url": "https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip", "ecosystem_export": "npm", "member": "GHSA-g77x-44xx-532m.json", "member_sha256": "f0564c75433bd74231830ea06d9f3a6b0ad96ac7da1ad511496fca4f8bc4beda", "source_generation": "1791478102533271", "source_observed_at": "2026-10-08T17:02:43.636144+00:00" } ] }, "record_id": "VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5", "references": [ { "type": "WEB", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47831" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a" }, { "type": "PACKAGE", "url": "https://github.com/vercel/next.js" } ], "related": [], "schema": "varexis-index-osv-projection/2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "type": "CVSS_V4" } ], "source_modified": "2026-09-10T03:50:19.720748758Z", "source_published": "2024-10-14T19:45:21Z", "status": "SOURCE_ASSERTION", "upstream": [], "withdrawn": null } }, { "record_id": "VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612", "url": "/api/index/advisories?record_id=VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612", "content_sha256": "9306ac5adea0d866efe59dfd42dc382f22918d5556053441d76ed314978ffef8", "evidence": { "admission": { "agent_boundary": { "prohibited_inference": [ "DO_NOT_INFER_PACKAGE_SAFETY_FROM_ABSENCE", "DO_NOT_INFER_DEPLOYMENT_AFFECTEDNESS_WITHOUT_VERSION_CONTEXT", "DO_NOT_TREAT_FIX_EVENT_AS_DEPLOYMENT_RECOMMENDATION", "DO_NOT_TREAT_EPSS_AS_SEVERITY_OR_LOCAL_RISK", "DO_NOT_TREAT_KEV_ABSENCE_AS_NO_EXPLOITATION" ], "requires_human_review": false, "routing_action": "RETURN_WITH_BOUNDARY", "safe_usage": "Evidence interpretation only. Not certification, approval, legal advice, financial advice, security deployment advice, or a determination that a system or product is safe. Absence of a listed vulnerability, exploitation indicator, affected condition, mitigation, or fix does not establish safety or non-affected status." }, "canonical_record_sha256": "c4ab27e68ce57137c344eb3689a1f969756a3f04e2f027f7d6c612c59cca5c91", "coverage_class": "SOURCE_COMPLETE", "disqualification": { "disqualifiers": [], "refusal_triggers": [] }, "lineage": "S2_WITH_S1_LINEAGE", "policy": "WHOLE_AMBIGUOUS_GROUPS_EXCLUDED_V1", "rights_review": "ATTRIBUTED_PROJECTION_APPROVED", "source_projection_sha256": "f9e56feb03a952406d56873697ff155a05def3499e1110103accd8999c0d101b", "uncertainty": { "ambiguities": [], "conflicts": [], "missing_evidence": [ "NO_SOURCE_SEVERITY_VECTOR" ], "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ] } }, "advisory_id": "GHSA-c59h-r6p8-q9wc", "affected": { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-c59h-r6p8-q9wc/GHSA-c59h-r6p8-q9wc.json" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "ranges": [ { "events": [ { "introduced": "0.9.9" }, { "fixed": "13.4.20-canary.13" } ], "type": "SEMVER" } ] }, "aliases": [ "CVE-2023-46298" ], "attribution": { "changes": "Attributed affected-package projection with dated enrichment and canonical admission boundaries. Narrative and internal priority fields omitted; original credits and source bindings retained. No endorsement.", "licence": "CC-BY-4.0", "notices": "https://varexis.tech/varexis-index/advisory-attribution.json", "publisher": "GitHub Advisory Database contributors", "source": "https://github.com/github/advisory-database" }, "authority_boundary": { "exploitability_verified": false, "full_schema_validation": false, "package_safe_claim": false, "version_range_evaluation": "NOT_IMPLEMENTED_REQUIRES_ECOSYSTEM_RESOLVER" }, "credits": [], "dataset_id": "osv-canonical-20261013-v1", "enrichment": { "boundary": "Direct CVE joins to captured feeds. Missing scores are unknown, not zero; absence is not safety.", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 225574, "cve": "CVE-2023-46298", "percentile": 0.69297, "probability": 0.01284 } ] }, "fixed_events": [ { "kind": "fixed", "projection_pointer": "/affected/ranges/0/events/1/fixed", "range_type": "SEMVER", "repository": null, "source_pointer": "/affected/0/ranges/0/events/1/fixed", "value": "13.4.20-canary.13" } ], "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "live_revalidation": false }, "evidence_class": "EXTERNAL_SOURCE_ASSERTION_NOT_INDEPENDENT_VERIFICATION", "freshness": { "captured_on": "2026-10-08", "live_revalidation": false, "reviewed_on": "2026-10-13" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "provenance": { "advisory_canonical_sha256": "d211bec6a2bb377a31104aa83bf128a638e8c82d1ac93409c92e93b6432236ec", "json_pointer": "/affected/0", "origins": [ { "archive_sha256": "87b192af2f38d0da54d8bf43a70f4c6343ce0211099545cf2fa9fae36a5978e0", "archive_url": "https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip", "ecosystem_export": "npm", "member": "GHSA-c59h-r6p8-q9wc.json", "member_sha256": "8f23930f611d4d3e44a155d71c1b3649dbd347c71fe6b62779719cae5b4580a1", "source_generation": "1791478102533271", "source_observed_at": "2026-10-08T17:02:43.636144+00:00" } ] }, "record_id": "VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46298" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/issues/45301" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/pull/54732" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648" }, { "type": "PACKAGE", "url": "https://github.com/vercel/next.js" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13" } ], "related": [], "schema": "varexis-index-osv-projection/2", "severity": [], "source_modified": "2023-11-08T04:13:42.231979Z", "source_published": "2023-10-22T03:30:23Z", "status": "SOURCE_ASSERTION", "upstream": [], "withdrawn": null } }, { "record_id": "VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75", "url": "/api/index/advisories?record_id=VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75", "content_sha256": "0864b2e0b6b4468248d7c950f43bd6d051eb10e6494b6f795c6741b9e13afd6f", "evidence": { "admission": { "agent_boundary": { "prohibited_inference": [ "DO_NOT_INFER_PACKAGE_SAFETY_FROM_ABSENCE", "DO_NOT_INFER_DEPLOYMENT_AFFECTEDNESS_WITHOUT_VERSION_CONTEXT", "DO_NOT_TREAT_FIX_EVENT_AS_DEPLOYMENT_RECOMMENDATION", "DO_NOT_TREAT_EPSS_AS_SEVERITY_OR_LOCAL_RISK", "DO_NOT_TREAT_KEV_ABSENCE_AS_NO_EXPLOITATION" ], "requires_human_review": false, "routing_action": "RETURN_WITH_BOUNDARY", "safe_usage": "Evidence interpretation only. Not certification, approval, legal advice, financial advice, security deployment advice, or a determination that a system or product is safe. Absence of a listed vulnerability, exploitation indicator, affected condition, mitigation, or fix does not establish safety or non-affected status." }, "canonical_record_sha256": "83733f2e874091b116ec26576c1a292ade41639f085301fa7750c33192e099b6", "coverage_class": "SOURCE_COMPLETE", "disqualification": { "disqualifiers": [], "refusal_triggers": [] }, "lineage": "S2_WITH_S1_LINEAGE", "policy": "WHOLE_AMBIGUOUS_GROUPS_EXCLUDED_V1", "rights_review": "ATTRIBUTED_PROJECTION_APPROVED", "source_projection_sha256": "3f38b1ef5367a55fffda4161ffa9ade04644e7357bdfe8a069f9753a639bbf04", "uncertainty": { "ambiguities": [], "conflicts": [], "missing_evidence": [], "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ] } }, "advisory_id": "GHSA-39w2-rjm5-chcv", "affected": { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-39w2-rjm5-chcv/GHSA-39w2-rjm5-chcv.json" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "ranges": [ { "events": [ { "introduced": "16.0.0" }, { "fixed": "16.3.8" } ], "type": "SEMVER" } ] }, "aliases": [ "CVE-2026-94486" ], "attribution": { "changes": "Attributed affected-package projection with dated enrichment and canonical admission boundaries. Narrative and internal priority fields omitted; original credits and source bindings retained. No endorsement.", "licence": "CC-BY-4.0", "notices": "https://varexis.tech/varexis-index/advisory-attribution.json", "publisher": "GitHub Advisory Database contributors", "source": "https://github.com/github/advisory-database" }, "authority_boundary": { "exploitability_verified": false, "full_schema_validation": false, "package_safe_claim": false, "version_range_evaluation": "NOT_IMPLEMENTED_REQUIRES_ECOSYSTEM_RESOLVER" }, "credits": [], "dataset_id": "osv-canonical-20261013-v1", "enrichment": { "boundary": "Direct CVE joins to captured feeds. Missing scores are unknown, not zero; absence is not safety.", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 382959, "cve": "CVE-2026-94486", "percentile": 0.01366, "probability": 0.00114 } ] }, "fixed_events": [ { "kind": "fixed", "projection_pointer": "/affected/ranges/0/events/1/fixed", "range_type": "SEMVER", "repository": null, "source_pointer": "/affected/0/ranges/0/events/1/fixed", "value": "16.3.8" } ], "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "live_revalidation": false }, "evidence_class": "EXTERNAL_SOURCE_ASSERTION_NOT_INDEPENDENT_VERIFICATION", "freshness": { "captured_on": "2026-10-08", "live_revalidation": false, "reviewed_on": "2026-10-13" }, "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "provenance": { "advisory_canonical_sha256": "c85c6ac4254e9fd5306bcdc5c041835498e509c052d37edf58ba2980e2c541c4", "json_pointer": "/affected/0", "origins": [ { "archive_sha256": "87b192af2f38d0da54d8bf43a70f4c6343ce0211099545cf2fa9fae36a5978e0", "archive_url": "https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip", "ecosystem_export": "npm", "member": "GHSA-39w2-rjm5-chcv.json", "member_sha256": "e5130cae0a552cd0be2b4b3d36d89c4c0c428de3c684d5bc87a7543e870aa861", "source_generation": "1791478102533271", "source_observed_at": "2026-10-08T17:02:43.636144+00:00" } ] }, "record_id": "VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75", "references": [ { "type": "WEB", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94486" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476" }, { "type": "PACKAGE", "url": "https://github.com/vercel/next.js" }, { "type": "WEB", "url": "https://github.com/vercel/next.js/releases/tag/v16.3.8" } ], "related": [], "schema": "varexis-index-osv-projection/2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "source_modified": "2026-10-07T20:45:05.342044468Z", "source_published": "2026-10-07T20:31:51Z", "status": "SOURCE_ASSERTION", "upstream": [], "withdrawn": null } } ], "basis": "Frozen external source projections. No fresh source review, independent tool behaviour test, exploitability verification or new research is performed by this delivery.", "boundary": "No match, withdrawal or absence from an explicit version list does not establish package safety. Range evaluation and deployment applicability are not implemented. EPSS and KEV are separately dated direct-CVE source joins, not a current asset-risk assessment. Missing scores are unknown, not zero. The complete contents are free to inspect or save locally. Payment adds server-saved retrieval of this exact version; Evidence Receipt adds an unsigned delivery record. Neither supplies a current safety verdict.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "nextjs-advisory-snapshot", "version": "1.0.0", "title": "Next.js: three dated advisory source assertions", "prepared_at_utc": "2026-10-16T01:21:27.533Z", "review_status": "FROZEN_EXTERNAL_SOURCE_PROJECTION_REVIEW", "source_checked_on": [ "2026-10-13" ], "source_capture_date": "2026-10-08", "source_capture_boundary": "Individual capture, publication, modification and enrichment dates are retained per member; these are not current deployment assessments.", "summary_markdown": "Preserve the recorded affected/fixed source assertions for these three named npm/next advisories, with their original publication, modification, capture and enrichment dates. This is a selected evidence comparison, not a complete package advisory inventory. Installed version, build settings, exposure and present source status are unresolved.", "comparison": [ { "advisory_id": "GHSA-g77x-44xx-532m", "aliases": [ "CVE-2024-47831" ], "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "affected_source_ranges": [ { "events": [ { "introduced": "10.0.0" }, { "fixed": "14.2.7" } ], "type": "SEMVER" } ], "source_published": "2024-10-14T19:45:21Z", "source_modified": "2026-09-10T03:50:19.720748758Z", "captured_on": "2026-10-08", "projection_reviewed_on": "2026-10-13", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 260863, "cve": "CVE-2024-47831", "percentile": 0.52976, "probability": 0.00732 } ] }, "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "source_severity_vectors": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "type": "CVSS_V4" } ], "source_severity_missing": false, "routing_action": "RETURN_WITH_BOUNDARY", "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ], "unknowns": [ "Installed version, build configuration and exposure not supplied", "Selected sources only; no coverage-completeness or current safety claim", "No range evaluation or live revalidation; missing scores and empty KEV matches are not safety" ] }, { "advisory_id": "GHSA-c59h-r6p8-q9wc", "aliases": [ "CVE-2023-46298" ], "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "affected_source_ranges": [ { "events": [ { "introduced": "0.9.9" }, { "fixed": "13.4.20-canary.13" } ], "type": "SEMVER" } ], "source_published": "2023-10-22T03:30:23Z", "source_modified": "2023-11-08T04:13:42.231979Z", "captured_on": "2026-10-08", "projection_reviewed_on": "2026-10-13", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 225574, "cve": "CVE-2023-46298", "percentile": 0.69297, "probability": 0.01284 } ] }, "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "source_severity_vectors": [], "source_severity_missing": true, "routing_action": "RETURN_WITH_BOUNDARY", "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ], "unknowns": [ "Installed version, build configuration and exposure not supplied", "Selected sources only; no coverage-completeness or current safety claim", "No range evaluation or live revalidation; missing scores and empty KEV matches are not safety" ] }, { "advisory_id": "GHSA-39w2-rjm5-chcv", "aliases": [ "CVE-2026-94486" ], "package": { "ecosystem": "npm", "name": "next", "purl": "pkg:npm/next" }, "affected_source_ranges": [ { "events": [ { "introduced": "16.0.0" }, { "fixed": "16.3.8" } ], "type": "SEMVER" } ], "source_published": "2026-10-07T20:31:51Z", "source_modified": "2026-10-07T20:45:05.342044468Z", "captured_on": "2026-10-08", "projection_reviewed_on": "2026-10-13", "epss": { "feed_sha256": "46d23ca8b8822d42f89f5de05eec8b104ee8c3e1d822bc16c6266edde1462cfc", "score_date": "2026-10-10", "score_dates": [ "2026-10-10" ], "scores": [ { "csv_data_row": 382959, "cve": "CVE-2026-94486", "percentile": 0.01366, "probability": 0.00114 } ] }, "kev": { "catalog_version": "2026.10.08", "feed_sha256": "fb1621beec7db19d99c1f919dede3d4cc01ad88acd16f79f1592929c4826dfee", "matches": [] }, "source_severity_vectors": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "source_severity_missing": false, "routing_action": "RETURN_WITH_BOUNDARY", "unsupported_claims": [ "PACKAGE_SAFE", "DEPLOYMENT_NOT_AFFECTED", "REMEDIATION_APPROVED", "EXPLOITABILITY_INDEPENDENTLY_VERIFIED" ], "unknowns": [ "Installed version, build configuration and exposure not supplied", "Selected sources only; no coverage-completeness or current safety claim", "No range evaluation or live revalidation; missing scores and empty KEV matches are not safety" ] } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "osv-canonical-20261013-v1", "route_id": "advisory:osv-canonical-20261013-v1:VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5", "question": "What does GHSA-g77x-44xx-532m record about npm/next in the 2026-10-08 snapshot?", "external_advisory_query": { "dataset_id": "osv-canonical-20261013-v1", "record_id": "VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5", "requested_version": null, "version_disposition": "NOT_REQUESTED", "range_evaluation": "NOT_IMPLEMENTED" }, "answer": "This frozen source advisory contains an affected-package assertion for npm/next. Ranges, exploitability and applicability to an installed deployment have not been evaluated.", "basis": "External OSV source projection captured 2026-10-08. Enrichment verified 2026-10-13; EPSS score date 2026-10-10. Source modification: 2026-09-10T03:50:19.720748758Z. Version disposition: NOT_REQUESTED. No live revalidation or independent verification. Original publishers and licences are retained in the record.", "boundary": "No match, withdrawal or absence from an explicit version list does not establish package safety. Range evaluation and deployment applicability are not implemented. EPSS and KEV are separately dated direct-CVE source joins, not a current asset-risk assessment. Missing scores are unknown, not zero. Public source data is free upstream and here. Payment only saves this version-bound snapshot or an unsigned delivery receipt.", "snapshot_sha256": "062c8f0e12a5b0ce0194f11d78432e1e6476bb4fdba05db4d2e8b621226f0cda", "record_ids": [ "VXI-OSV-00dcfd09566248d312c068773642a33a5266ec38-7957083216b5" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "osv-canonical-20261013-v1", "route_id": "advisory:osv-canonical-20261013-v1:VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612", "question": "What does GHSA-c59h-r6p8-q9wc record about npm/next in the 2026-10-08 snapshot?", "external_advisory_query": { "dataset_id": "osv-canonical-20261013-v1", "record_id": "VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612", "requested_version": null, "version_disposition": "NOT_REQUESTED", "range_evaluation": "NOT_IMPLEMENTED" }, "answer": "This frozen source advisory contains an affected-package assertion for npm/next. Ranges, exploitability and applicability to an installed deployment have not been evaluated.", "basis": "External OSV source projection captured 2026-10-08. Enrichment verified 2026-10-13; EPSS score date 2026-10-10. Source modification: 2023-11-08T04:13:42.231979Z. Version disposition: NOT_REQUESTED. No live revalidation or independent verification. Original publishers and licences are retained in the record.", "boundary": "No match, withdrawal or absence from an explicit version list does not establish package safety. Range evaluation and deployment applicability are not implemented. EPSS and KEV are separately dated direct-CVE source joins, not a current asset-risk assessment. Missing scores are unknown, not zero. Public source data is free upstream and here. Payment only saves this version-bound snapshot or an unsigned delivery receipt.", "snapshot_sha256": "fde856ac44d4205de875b1cfff21bce02ee3bafa02e8e62e004830d0ac5bd6e8", "record_ids": [ "VXI-OSV-0eb087e4456480db7b701d09df9c487ddc979573-609d01b74612" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "osv-canonical-20261013-v1", "route_id": "advisory:osv-canonical-20261013-v1:VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75", "question": "What does GHSA-39w2-rjm5-chcv record about npm/next in the 2026-10-08 snapshot?", "external_advisory_query": { "dataset_id": "osv-canonical-20261013-v1", "record_id": "VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75", "requested_version": null, "version_disposition": "NOT_REQUESTED", "range_evaluation": "NOT_IMPLEMENTED" }, "answer": "This frozen source advisory contains an affected-package assertion for npm/next. Ranges, exploitability and applicability to an installed deployment have not been evaluated.", "basis": "External OSV source projection captured 2026-10-08. Enrichment verified 2026-10-13; EPSS score date 2026-10-10. Source modification: 2026-10-07T20:45:05.342044468Z. Version disposition: NOT_REQUESTED. No live revalidation or independent verification. Original publishers and licences are retained in the record.", "boundary": "No match, withdrawal or absence from an explicit version list does not establish package safety. Range evaluation and deployment applicability are not implemented. EPSS and KEV are separately dated direct-CVE source joins, not a current asset-risk assessment. Missing scores are unknown, not zero. Public source data is free upstream and here. Payment only saves this version-bound snapshot or an unsigned delivery receipt.", "snapshot_sha256": "fcd5ac8676ce138aec731529f730482f42c8c04c83884fb2f53c3ad2bdb88361", "record_ids": [ "VXI-OSV-10e21bdfa027ab126a74204fe8a895cb6b736e79-04da9b7ccb75" ] } ], "rights_review": { "status": "REVIEWED_ASSEMBLY_OF_EXISTING_ATTRIBUTED_PROJECTIONS", "source_admission": "ATTRIBUTED_PROJECTION_APPROVED", "licences": [ "CC-BY-4.0" ], "attribution_retained": true, "independent_testing": false, "redistribution": "Retain original attribution, licence links, changes notices and all member bindings. No endorsement or exclusive source ownership." }, "delivery_unit": { "kind": "one_published_route", "member_count": 3, "developer_query_units": 1, "research_query_units": 1, "extra_member_purchases": false, "automatic_refresh": false } }, "snapshot_sha256": "762bf0c67fd4d8d52192ce617ba84e9225c4c596802924bfd71d2bf84c6b2e21" }